CVE-2007-6412

Published: Dec 17, 2007Modified: Apr 23, 2026

6.8

Vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Exploitability: 8.6 / Impact: 6.4

Source: NVD

Description

Direct static code injection vulnerability in wiki/index.php in Bitweaver 2.0.0 and earlier, when comments are enabled, allows remote attackers to inject arbitrary PHP code via an editcomments action.

Affected (1)

Products: Bitweaver: Bitweaver

Bitweaver

1 product

Bitweaver

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Bitweaver Bitweaver	Up to 2.0.0

Related CWEs

CWE-94

Improper Control of Generation of Code ('Code Injection')

The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

References (12)

http://osvdb.org/40148

Source: cve@mitre.org

http://securityreason.com/securityalert/3428

Source: cve@mitre.org

http://securityreason.com/securityalert/3454

Source: cve@mitre.org

http://www.hackerscenter.com/archive/view.asp?id=28129

Source: cve@mitre.org

Exploit

http://www.securityfocus.com/archive/1/484805/100/0/threaded

Source: cve@mitre.org

http://www.securityfocus.com/bid/26801

Source: cve@mitre.org

Exploit

http://osvdb.org/40148