PHPDevShell Remote Privilege Escalation Vulnerability

Bugtraq ID:	26615
Class:	Access Validation Error
CVE:	CVE-2007-6186 CVE-2007-6174
Remote:	Yes
Local:	No
Published:	Nov 27 2007 12:00AM
Updated:	Jul 05 2016 10:00PM
Credit:	The vendor disclosed this vulnerability.
Vulnerable:	PHPDevShell PHPDevShell 0.6
Not Vulnerable:	PHPDevShell PHPDevShell 0.7

PHPDevShell Remote Privilege Escalation Vulnerability

PHPDevShell is prone to a remote privilege-escalation vulnerability due to an unspecified error.

Successfully exploiting this issue allows remote attackers to gain administrative privileges to the application and execute malicious PHP code in the context of the webserver process. This may facilitate a compromise of the webserver and the underlying system; other attacks are also possible.

The issue affects versions prior to PHPDevShell 0.7.0.

PHPDevShell Remote Privilege Escalation Vulnerability

Attackers can use a browser to exploit this issue.

PHPDevShell Remote Privilege Escalation Vulnerability

Solution:
The vendor has released updates to address this issue. Please see the references for more information.


PHPDevShell PHPDevShell 0.6

• PHPDevShell PHPDevShell_V070a_Stable.tar.gz
  http://downloads.sourceforge.net/phpdevshell/PHPDevShell_V070a_Stable. tar.gz

PHPDevShell Remote Privilege Escalation Vulnerability

References:

• PHPDevShell Homepage (PHPDevShell)
  
• PHPDevShell Release Notes (PHPDevShell)