SpeedTech STPHPLib STPHPLIB_DIR Parameter Multiple Remote File Include Vulnerabilities

Bugtraq ID:	25525
Class:	Input Validation Error
CVE:	CVE-2007-4738 CVE-2007-4737
Remote:	Yes
Local:	No
Published:	Sep 04 2007 12:00AM
Updated:	Jul 05 2016 10:00PM
Credit:	leetsecurity and an anonymous person is credited with the discovery of these vulnerabilities.
Vulnerable:	SpeedTech STPHPLib 0.8.0 (Hammer)
Not Vulnerable:

SpeedTech STPHPLib STPHPLIB_DIR Parameter Multiple Remote File Include Vulnerabilities

STPHPLib is prone to multiple remote file-include vulnerabilities because it fails to sufficiently sanitize user-supplied data.

An attacker can exploit these issues to execute malicious PHP code in the context of the webserver process. This may allow the attacker to compromise the application and the underlying system; other attacks are also possible.

These issues affect STPHPLib 0.8.0 (Hammer); other versions may also be affected.

SpeedTech STPHPLib STPHPLIB_DIR Parameter Multiple Remote File Include Vulnerabilities

Attackers can use a browser to exploit these issues.

SpeedTech STPHPLib STPHPLIB_DIR Parameter Multiple Remote File Include Vulnerabilities

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

SpeedTech STPHPLib STPHPLIB_DIR Parameter Multiple Remote File Include Vulnerabilities

References:

• STPHPLib Web Site (SpeedTech)