CVE-2007-2985

Published: Jun 1, 2007Modified: Apr 23, 2026

10.0

Vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Exploitability: 10.0 / Impact: 10.0

Source: NVD

Description

Pheap 2.0 allows remote attackers to bypass authentication by setting a pheap_login cookie value to the administrator's username, which can be used to (1) obtain sensitive information, including the administrator password, via settings.php or (2) upload and execute arbitrary PHP code via an update_doc action in edit.php.

Affected (1)

Products: Pheap: Pheap

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Pheap Pheap	Version 2.0

Related CWEs

References (8)

http://osvdb.org/36737

Source: cve@mitre.org

http://secunia.com/advisories/25460

Source: cve@mitre.org

Vendor Advisory

https://exchange.xforce.ibmcloud.com/vulnerabilities/34592

Source: cve@mitre.org

https://www.exploit-db.com/exploits/4006

Source: cve@mitre.org

http://osvdb.org/36737

Source: af854a3a-2127-422b-91ae-364da2661108

http://secunia.com/advisories/25460

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

https://exchange.xforce.ibmcloud.com/vulnerabilities/34592

Source: af854a3a-2127-422b-91ae-364da2661108

https://www.exploit-db.com/exploits/4006

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.