CVE-2007-1601

Severity: medium (CVSS 5.0 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2007-03-22 · updated 2026-06-16

Description

Directory traversal vulnerability in check_vote.php in Weekly Drawing Contest 0.0.1 allows remote attackers to read arbitrary files via a .. (dot dot) in the order parameter. NOTE: another researcher disputes this vulnerability, noting that the order variable is not used in any context that allows opening files

Affected products

Weekly Drawing Contest: 0.0.1

References

http://osvdb.org/35148
http://securityreason.com/securityalert/2453
http://www.securityfocus.com/archive/1/462663/100/100/threaded
http://www.securityfocus.com/archive/1/462702/100/100/threaded
http://osvdb.org/35148
http://securityreason.com/securityalert/2453
http://www.securityfocus.com/archive/1/462663/100/100/threaded
http://www.securityfocus.com/archive/1/462702/100/100/threaded

Get alerted when CVE-2007-1601 or the next vulnerability affects your stack