CVE-2004-0030

CriticalCVSS 9.8/10Last modified Jun 16, 2026

Description

PHP remote file inclusion vulnerability in (1) functions.php, (2) authentication_index.php, and (3) config_gedcom.php for PHPGEDVIEW 2.61 allows remote attackers to execute arbitrary PHP code by modifying the PGV_BASE_DIRECTORY parameter to reference a URL on a remote web server that contains the code.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-829

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://marc.info/?l=bugtraq&m=107340840209453&w=2Mailing List, Patch
http://secunia.com/advisories/10565Broken Link, Vendor Advisory
http://www.osvdb.org/3343Broken Link
http://www.securityfocus.com/bid/9368Broken Link, Third Party Advisory, VDB Entry
http://www.securitytracker.com/id?1008632Broken Link, Third Party Advisory, VDB Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/14159Third Party Advisory, VDB Entry
http://marc.info/?l=bugtraq&m=107340840209453&w=2Mailing List, Patch
http://secunia.com/advisories/10565Broken Link, Vendor Advisory
http://www.osvdb.org/3343Broken Link
http://www.securityfocus.com/bid/9368Broken Link, Third Party Advisory, VDB Entry
http://www.securitytracker.com/id?1008632Broken Link, Third Party Advisory, VDB Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/14159Third Party Advisory, VDB Entry

Timeline

Published: Jan 20, 2004
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2004

CVE-2004-00317.5PHPGEDVIEW 2.61 allows remote attackers to reinstall the software and change the administrator password via a direct HTTP request to editcon CVE-2004-00326.8Cross-site scripting (XSS) vulnerability in search.php in PHPGEDVIEW 2.61 allows remote attackers to inject arbitrary HTML and web script vi CVE-2004-00335.0admin.php in PHPGEDVIEW 2.61 allows remote attackers to obtain sensitive information via an action parameter with a phpinfo command.CVE-2004-00344.3Multiple cross-site scripting (XSS) vulnerabilities in Phorum 3.4.5 and earlier allow remote attackers to inject arbitrary HTML or web scrip CVE-2004-00357.5SQL injection vulnerability in register.php for Phorum 3.4.5 and earlier allows remote attackers to execute arbitrary SQL commands via the h CVE-2004-00365.0SQL injection vulnerability in calendar.php for vBulletin Forum 2.3.x before 2.3.4 allows remote attackers to steal sensitive information vi CVE-2004-00377.5FirstClass Desktop Client 7.1 allows remote attackers to execute arbitrary commands via hyperlinks in FirstClass RTF messages.CVE-2004-00387.5McAfee ePolicy Orchestrator (ePO) 2.5.1 Patch 13 and 3.0 SP2a Patch 3 allows remote attackers to execute arbitrary commands via certain HTTP CVE-2004-003910.0Multiple format string vulnerabilities in HTTP Application Intelligence (AI) component in Check Point Firewall-1 NG-AI R55 and R54, and Chec CVE-2004-004010.0Stack-based buffer overflow in Check Point VPN-1 Server 4.1 through 4.1 SP6 and Check Point SecuRemote/SecureClient 4.1 through 4.1 build 42 CVE-2004-00417.5The mod_auth_shadow module 1.4 and earlier does not properly enforce the expiration of a user account and password, which could allow remote CVE-2004-00425.0vsftpd 1.1.3 generates different error messages depending on whether or not a valid username exists, which allows remote attackers to identi