CVE-2007-1486

CRITICAL 10.0CVE-2007-1486 · Published 16/03/2007 · updated 16/06/2026

In short

CVE-2007-1486 is a CRITICAL (CVSS 10.0) vulnerability affecting lazarus guestbook (carbonize).
Chance of exploitation in the next 30 days (EPSS): 2.9%, higher than 87.1% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
lazarus guestbook carbonize	`≤ 1.7.2`	No fix yet

Description

PHP remote file inclusion vulnerability in template.class.php in Carbonize Lazarus Guestbook before 1.7.3 allows remote attackers to execute arbitrary PHP code via a URL in the include_path parameter to admin.php, probably due to a dynamic variable evaluation vulnerability.

References

carbonize.co.uk/Lazarus/Forum/index.php
securityreason.com/securityalert/2432
attrition.org/pipermail/vim/2007-March/001417.html
securityfocus.com/archive/1/462183/100/100/threaded
securityfocus.com/archive/1/462235/100/100/threaded
securityfocus.com/archive/1/463041/100/0/threaded
securityfocus.com/archive/1/469218/100/0/threaded
vupen.com/english/advisories/2007/0874

More vulnerabilities in lazarus guestbook

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free