TeamCalPro 3.1.000 - Multiple Remote / Local File Inclusion

CVE编号

CVE-2007-6553

利用情况

暂无

补丁情况

N/A

披露时间

2007-12-28

漏洞描述

Multiple PHP remote file inclusion vulnerabilities in TeamCal Pro 3.1.000 and earlier allow remote attackers to execute arbitrary PHP code via a URL in the CONF[app_root] parameter to (1) tcuser.class.php, (2) absencecount.inc.php, (3) avatar.inc.php, (4) csvhandler.class.php, (5) functions.tcpro.php, (6) header.html.inc.php, (7) joomlajack.tcpro.php, (8) menu.inc.php, (9) other.inc.php, (10) tcabsence.class.php, (11) tcabsencegroup.class.php, (12) tcallowance.class.php, (13) tcannouncement.class.php, (14) tcconfig.class.php, (15) tcdaynote.class.php, (16) tcgroup.class.php, (17) tcholiday.class.php, (18) tclogin.class.php, (19) tcmonth.class.php, (20) tctemplate.class.php, (21) tcusergroup.class.php, or (22) tcuseroption.class.php in includes/, possibly a related issue to CVE-2006-4845.

解决建议

建议您更新当前系统或软件至最新版，完成漏洞的修复。

参考链接
http://osvdb.org/39805
http://osvdb.org/39806
http://osvdb.org/39807
http://osvdb.org/39808
http://osvdb.org/39809
http://osvdb.org/39810
http://osvdb.org/39811
http://osvdb.org/39812
http://osvdb.org/39813
http://osvdb.org/39814
http://osvdb.org/39815
http://osvdb.org/39816
http://osvdb.org/39817
http://osvdb.org/39818
http://osvdb.org/39819
http://osvdb.org/39820
http://osvdb.org/39821
http://osvdb.org/39822
http://osvdb.org/39823
http://osvdb.org/39824
http://osvdb.org/39825
http://osvdb.org/39826
http://www.securityfocus.com/bid/27022
https://exchange.xforce.ibmcloud.com/vulnerabilities/39212
https://www.exploit-db.com/exploits/4785

受影响软件情况

#	类型	厂商	产品	版本	影响面
1
	运行在以下环境
	应用	george_lewe	teamcal_pro	*		Up to (including) 3.1.000

CVSS3评分 6.8

• 攻击路径 网络
• 攻击复杂度 N/A
• 权限要求 无
• 影响范围 N/A
• 用户交互 无
• 可用性 部分地
• 保密性 部分地
• 完整性 部分地

AV:N/AC:M/Au:N/C:P/I:P/A:P

CWE-ID	漏洞类型
CWE-94	对生成代码的控制不恰当（代码注入）

Exp相关链接

• https://www.exploit-db.com/exploits/4785

- avd.aliyun.com