CVE-2007-6553
Description
Multiple PHP remote file inclusion vulnerabilities in TeamCal Pro 3.1.000 and earlier allow remote attackers to execute arbitrary PHP code via a URL in the CONF[app_root] parameter to (1) tcuser.class.php, (2) absencecount.inc.php, (3) avatar.inc.php, (4) csvhandler.class.php, (5) functions.tcpro.php, (6) header.html.inc.php, (7) joomlajack.tcpro.php, (8) menu.inc.php, (9) other.inc.php, (10) tcabsence.class.php, (11) tcabsencegroup.class.php, (12) tcallowance.class.php, (13) tcannouncement.class.php, (14) tcconfig.class.php, (15) tcdaynote.class.php, (16) tcgroup.class.php, (17) tcholiday.class.php, (18) tclogin.class.php, (19) tcmonth.class.php, (20) tctemplate.class.php, (21) tcusergroup.class.php, or (22) tcuseroption.class.php in includes/, possibly a related issue to CVE-2006-4845.
Affected products
1Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
25- www.securityfocus.com/bid/27022nvdExploit
- osvdb.org/39805nvd
- osvdb.org/39806nvd
- osvdb.org/39807nvd
- osvdb.org/39808nvd
- osvdb.org/39809nvd
- osvdb.org/39810nvd
- osvdb.org/39811nvd
- osvdb.org/39812nvd
- osvdb.org/39813nvd
- osvdb.org/39814nvd
- osvdb.org/39815nvd
- osvdb.org/39816nvd
- osvdb.org/39817nvd
- osvdb.org/39818nvd
- osvdb.org/39819nvd
- osvdb.org/39820nvd
- osvdb.org/39821nvd
- osvdb.org/39822nvd
- osvdb.org/39823nvd
- osvdb.org/39824nvd
- osvdb.org/39825nvd
- osvdb.org/39826nvd
- exchange.xforce.ibmcloud.com/vulnerabilities/39212nvd
- www.exploit-db.com/exploits/4785nvd
News mentions
0No linked articles in our index yet.