CVE-2007-5186

MEDIUM 6.8CVE-2007-5186 · Published 03/10/2007 · updated 16/06/2026

Package	Affected versions	Patched versions
segue cms segue_cms	`≤ 1.8.4`	No fix yet

Description

PHP remote file inclusion vulnerability in index.php in Segue CMS 1.8.4 and earlier, when register_globals is disabled, allows remote attackers to execute arbitrary PHP code via a URL in the themesdir parameter, a different vector than CVE-2006-5497. NOTE: this issue was disputed, but the dispute was retracted after additional analysis.

References

secunia.com/advisories/27025 · Vendor Advisory
sourceforge.net/project/shownotes.php
attrition.org/pipermail/vim/2007-October/001811.html
attrition.org/pipermail/vim/2007-October/001816.html
securityfocus.com/bid/25889
vupen.com/english/advisories/2007/3342 · Vendor Advisory
exchange.xforce.ibmcloud.com/vulnerabilities/36903
exploit-db.com/exploits/4476

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free