CVE-2007-4738

Published: Sep 6, 2007Modified: Apr 23, 2026

7.5

Vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Exploitability: 10.0 / Impact: 6.4

Source: NVD

Description

Multiple PHP remote file inclusion vulnerabilities in SpeedTech PHP Library (STPHPLibrary) 0.8.0 allow remote attackers to execute arbitrary PHP code via a URL in the (1) db_conf or (2) ADODB_DIR parameter to utils/stphpimage_show.php; or a URL in the STPHPLIB_DIR parameter to (3) stphpbutton.php, (4) stphpcheckbox.php, (5) stphpcheckboxwithcaption.php, (6) stphpcheckgroup.php, (7) stphpcomponent.php, (8) stphpcontrolwithcaption.php, (9) stphpedit.php, (10) stphpeditwithcaption.php, (11) stphphr.php, (12) stphpimage.php, (13) stphpimagewithcaption.php, (14) stphplabel.php, (15) stphplistbox.php, (16) stphplistboxwithcaption.php, (17) stphplocale.php, (18) stphppanel.php, (19) stphpradiobutton.php, (20) stphpradiobuttonwithcaption.php, (21) stphpradiogroup.php, (22) stphprichbutton.php, (23) stphpspacer.php, (24) stphptable.php, (25) stphptablecell.php, (26) stphptablerow.php, (27) stphptabpanel.php, (28) stphptabtitle.php, (29) stphptextarea.php, (30) stphptextareawithcaption.php, (31) stphptoolbar.php, (32) stphpwindow.php, (33) stphpxmldoc.php, or (34) stphpxmlelement.php, a different set of vectors than CVE-2007-4737. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.

Affected (1)

Products: Speedtech: Stphplibrary

Speedtech

1 product

Stphplibrary

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Speedtech Stphplibrary	Version 0.8.0

Related CWEs

CWE-20

Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

CWE-94

Improper Control of Generation of Code ('Code Injection')

The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

References (72)

http://osvdb.org/39073

Source: cve@mitre.org

http://osvdb.org/39074

Source: cve@mitre.org

http://osvdb.org/39075

Source: cve@mitre.org

http://osvdb.org/39076

Source: cve@mitre.org

http://osvdb.org/39077

Source: cve@mitre.org

http://osvdb.org/39078

Source: cve@mitre.org

http://osvdb.org/39079

Source: cve@mitre.org

http://osvdb.org/39080

Source: cve@mitre.org

http://osvdb.org/39081

Source: cve@mitre.org

http://osvdb.org/39082

Source: cve@mitre.org

http://osvdb.org/39083

Source: cve@mitre.org

http://osvdb.org/39084

Source: cve@mitre.org

http://osvdb.org/39085

Source: cve@mitre.org

http://osvdb.org/39086

Source: cve@mitre.org

http://osvdb.org/39087

Source: cve@mitre.org

http://osvdb.org/39088

Source: cve@mitre.org

http://osvdb.org/39089

Source: cve@mitre.org

http://osvdb.org/39090

Source: cve@mitre.org

http://osvdb.org/39091

Source: cve@mitre.org

http://osvdb.org/39092

Source: cve@mitre.org

http://osvdb.org/39093

Source: cve@mitre.org

http://osvdb.org/39094

Source: cve@mitre.org

http://osvdb.org/39095

Source: cve@mitre.org

http://osvdb.org/39096

Source: cve@mitre.org

http://osvdb.org/39097

Source: cve@mitre.org

http://osvdb.org/39098

Source: cve@mitre.org

http://osvdb.org/39099

Source: cve@mitre.org

http://osvdb.org/39100

Source: cve@mitre.org

http://osvdb.org/39101

Source: cve@mitre.org

http://osvdb.org/39102

Source: cve@mitre.org

http://osvdb.org/39103

Source: cve@mitre.org

http://osvdb.org/39104

Source: cve@mitre.org

http://osvdb.org/39105

Source: cve@mitre.org

http://secunia.com/advisories/26658

Source: cve@mitre.org

Vendor Advisory

http://www.securityfocus.com/bid/25525

Source: cve@mitre.org

https://exchange.xforce.ibmcloud.com/vulnerabilities/36417

Source: cve@mitre.org

http://osvdb.org/39073