CVE-2007-6147

MEDIUM 6.8CVE-2007-6147 · Published 27/11/2007 · updated 16/06/2026

In short

CVE-2007-6147 is a MEDIUM (CVSS 6.8) vulnerability affecting iapr commence (iaprcommence).
Chance of exploitation in the next 30 days (EPSS): 2.0%, higher than 80.7% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
iapr commence iaprcommence	`= 1.3`	No fix yet

Description

Multiple PHP remote file inclusion vulnerabilities in IAPR COMMENCE 1.3 allow remote attackers to execute arbitrary PHP code via a URL in the (a) php_root_path and sometimes the (b) privilege_root_path parameter to various PHP scripts under (1) admin/includes/, (2) admin/phase/, (3) includes/, (4) includes/page_includes/, (5) reviewer/includes/, (6) reviewer/phase/, and (7) user/phase/.

References

secunia.com/advisories/27788 · Vendor Advisory
securityfocus.com/bid/26570 · Exploit
exchange.xforce.ibmcloud.com/vulnerabilities/38641
exploit-db.com/exploits/4659

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free