CVE-2007-5453

Published: Oct 14, 2007Modified: Apr 23, 2026

8.5

Vector

AV:N/AC:M/Au:S/C:C/I:C/A:C

Exploitability: 6.8 / Impact: 10.0

Source: NVD

Description

Multiple eval injection vulnerabilities in Php-Stats 0.1.9.2 allow remote authenticated administrators to execute arbitrary code by writing PHP sequences to the php-stats-options record in the _options table, which is used in an eval function call by (1) admin.php, (2) click.php, (3) download.php, and unspecified other files, as demonstrated by modifying _options through a backup restore action in admin.php.

Affected (1)

Products: Php Stats: Php Stats

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Php Stats Php Stats	Version 0.1.9.2

Related CWEs

Improper Control of Generation of Code ('Code Injection')

The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

References (6)

http://osvdb.org/43480

Source: cve@mitre.org

http://www.securityfocus.com/bid/26022

Source: cve@mitre.org

https://www.exploit-db.com/exploits/4513

Source: cve@mitre.org

http://osvdb.org/43480

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.securityfocus.com/bid/26022

Source: af854a3a-2127-422b-91ae-364da2661108

https://www.exploit-db.com/exploits/4513

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.