CVE-2007-4640

Published: Aug 31, 2007Modified: Apr 23, 2026

6.4

Vector

AV:N/AC:L/Au:N/C:P/I:P/A:N

Exploitability: 10.0 / Impact: 4.9

Source: NVD

Description

Unrestricted file upload vulnerability in index.php in Pakupaku CMS 0.4 and earlier allows remote attackers to upload and execute arbitrary PHP files in uploads/ via an Uploads action.

Affected (1)

Products: Pakupaku: Pakupaku Cms

Pakupaku

1 product

Pakupaku Cms

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Pakupaku Pakupaku Cms	Up to 0.4

Related CWEs

CWE-264

CWE-94

Improper Control of Generation of Code ('Code Injection')

The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

References (10)

http://osvdb.org/38670

Source: cve@mitre.org

http://secunia.com/advisories/26598

Source: cve@mitre.org

Vendor Advisory

http://www.securityfocus.com/bid/25491

Source: cve@mitre.org

https://exchange.xforce.ibmcloud.com/vulnerabilities/36357

Source: cve@mitre.org

https://www.exploit-db.com/exploits/4341

Source: cve@mitre.org

http://osvdb.org/38670