CVE-2007-2985 | BDVDB-2026-24472 Detail

Description#

Pheap 2.0 allows remote attackers to bypass authentication by setting a pheap_login cookie value to the administrator's username, which can be used to (1) obtain sensitive information, including the administrator password, via settings.php or (2) upload and execute arbitrary PHP code via an update_doc action in edit.php.

Impact#

No impact statement in the source data.

Weaknesses#

No weakness recorded in the source data.

References#

http://osvdb.org/36737
https://www.exploit-db.com/exploits/4006
http://secunia.com/advisories/25460
https://exchange.xforce.ibmcloud.com/vulnerabilities/34592

Exploit#

https://www.exploit-db.com/exploits/4006

History#

Version 12007-06-01Record published in the CVE List.
Version 22024-08-07Most recent update recorded in the CVE List.