CVE-2007-6550

Published: Dec 28, 2007Modified: Apr 23, 2026

7.5

Vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Exploitability: 10.0 / Impact: 6.4

Source: NVD

Description

form.php in PMOS Help Desk 2.4 and earlier sends a redirect to the web browser but does not exit, which allows remote attackers to conduct eval injection attacks and execute arbitrary PHP code via the options array parameter.

Affected (1)

Products: Pmos Helpdesk: Pmos Helpdesk

Pmos Helpdesk

1 product

Pmos Helpdesk

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Pmos Helpdesk Pmos Helpdesk	Up to 2.4

Related CWEs

CWE-94

Improper Control of Generation of Code ('Code Injection')

The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

References (12)

http://osvdb.org/42662

Source: cve@mitre.org

http://secunia.com/advisories/28201

Source: cve@mitre.org

http://www.securityfocus.com/bid/27032

Source: cve@mitre.org

http://www.vupen.com/english/advisories/2007/4321

Source: cve@mitre.org

https://exchange.xforce.ibmcloud.com/vulnerabilities/39274

Source: cve@mitre.org

https://www.exploit-db.com/exploits/4789

Source: cve@mitre.org

http://osvdb.org/42662