CVE-2007-5440

HighCVSS 7.5/10Last modified Jun 16, 2026

Description

Multiple PHP remote file inclusion vulnerabilities in CRS Manager allow remote attackers to execute arbitrary PHP code via a URL in the DOCUMENT_ROOT parameter to (1) index.php or (2) login.php. NOTE: this issue is disputed by CVE, since DOCUMENT_ROOT cannot be modified by an attacker

Metrics

CVSS 2.0 7.5/10AV:N/AC:L/Au:N/C:P/I:P/A:P

Weakness enumeration

CWE-20

Affected software

No affected versions have been published.

Timeline

Published: Oct 14, 2007
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2007

CVE-2007-54416.5CMS Made Simple 1.1.3.1 does not check the permissions assigned to users in some situations, which allows remote authenticated users to perf CVE-2007-54423.5CMS Made Simple 1.1.3.1 does not check the permissions assigned to users who attempt uploads, which allows remote authenticated users to upl CVE-2007-54434.3Multiple cross-site scripting (XSS) vulnerabilities in CMS Made Simple 1.1.3.1 allow remote attackers to inject arbitrary web script or HTML CVE-2007-54445.0CMS Made Simple 1.1.3.1 allows remote attackers to obtain the full path via a direct request for unspecified files.CVE-2007-54456.8Buffer overflow in the DB Software Laboratory VImpX (VImpAX1) ActiveX control in VImpX.ocx 4.7.3.0 allows remote attackers to execute arbitr CVE-2007-54466.4Absolute path traversal vulnerability in a certain ActiveX control in PBEmail7Ax.dll in PBEmail 7 ActiveX Edition allows remote attackers to CVE-2007-54474.3ioncube_loader_win_5.2.dll in the ionCube Loader 6.5 extension for PHP 5.2.4 does not follow safe_mode and disable_functions restrictions, w CVE-2007-54484.3Madwifi 0.9.3.2 and earlier allows remote attackers to cause a denial of service (panic) via a beacon frame with a large length value in the CVE-2007-54497.5SQL injection vulnerability in searchresult.php in Softbiz Recipes Portal Script allows remote attackers to execute arbitrary SQL commands v CVE-2007-54509.3Unspecified vulnerability in Safari on the Apple iPod touch (aka iTouch) and iPhone 1.1.1 allows user-assisted remote attackers to cause a d CVE-2007-54516.8PHP remote file inclusion vulnerability in admin.color.php in the com_colorlab (aka com_color) 1.0 component for Joomla! allows remote attac CVE-2007-545210.0Multiple SQL injection vulnerabilities in php-stats.recjs.php in Php-Stats 0.1.9.2 allow remote attackers to execute arbitrary SQL commands