CVE-2007-2458

HighCVSS 7.5/10Last modified Jun 16, 2026

Description

Multiple PHP remote file inclusion vulnerabilities in Pixaria Gallery before 1.4.3 allow remote attackers to execute arbitrary PHP code via a URL in the cfg[sys][base_path] parameter to psg.smarty.lib.php and certain include and library scripts, a different vector than CVE-2007-2457.

Metrics

CVSS 2.0 7.5/10AV:N/AC:L/Au:N/C:P/I:P/A:P

Weakness enumeration

CWE-94

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://pixaria.com/index.history.phpURL Repurposed
http://secunia.com/advisories/24821Vendor Advisory
http://www.pixaria.com/news/article/70/URL Repurposed
http://www.pixaria.com/news/article/71/Patch, URL Repurposed
http://www.vupen.com/english/advisories/2007/1390Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/33662
https://www.exploit-db.com/exploits/3733
http://pixaria.com/index.history.phpURL Repurposed
http://secunia.com/advisories/24821Vendor Advisory
http://www.pixaria.com/news/article/70/URL Repurposed
http://www.pixaria.com/news/article/71/Patch, URL Repurposed
http://www.vupen.com/english/advisories/2007/1390Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/33662
https://www.exploit-db.com/exploits/3733

Timeline

Published: May 2, 2007
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2007

CVE-2007-24597.8Heap-based buffer overflow in the BMP reader (bmp.c) in Imager perl module (libimager-perl) 0.45 through 0.56 allows remote attackers to cau CVE-2007-24607.5PHP remote file inclusion vulnerability in modules/admin/include/config.php in FireFly 1.1.01 and earlier allows remote attackers to execute CVE-2007-24617.8The DHCP relay agent in Cisco Adaptive Security Appliance (ASA) and PIX 7.2 allows remote attackers to cause a denial of service (dropped pa CVE-2007-246210.0Unspecified vulnerability in Cisco Adaptive Security Appliance (ASA) and PIX 7.2 before 7.2(2)8, when using Layer 2 Tunneling Protocol (L2TP CVE-2007-24637.8Unspecified vulnerability in Cisco Adaptive Security Appliance (ASA) and PIX 7.1 before 7.1(2)49 and 7.2 before 7.2(2)17 allows remote attac CVE-2007-24647.1Race condition in Cisco Adaptive Security Appliance (ASA) and PIX 7.1 before 7.1(2)49 and 7.2 before 7.2(2)19, when using "clientless SSL VP CVE-2007-24654.7Unspecified vulnerability in Sun Solaris 9, when Solaris Auditing (BSM) is enabled for file read, write, attribute modify, create, or delete CVE-2007-24667.8Unspecified vulnerability in the LDAP Software Development Kit (SDK) for C, as used in Sun Java System Directory Server 5.2 up to Patch 4 an CVE-2007-24674.9ZoneAlarm Pro 6.5.737.000, 6.1.744.001, and possibly earlier versions and other products, allows local users to cause a denial of service (s CVE-2007-24684.9Unspecified vulnerability in HP OpenVMS for Integrity Servers 8.2-1 and 8.3 allows local users to cause a denial of service (crash) via "Pro CVE-2007-24697.5SQL injection vulnerability in index.php in FileRun 1.0 and earlier allows remote attackers to execute arbitrary SQL commands via the fid pa CVE-2007-24705.8Multiple cross-site scripting (XSS) vulnerabilities in index.php in FileRun 1.0 and earlier allow remote attackers to inject arbitrary web s