CVE-2007-4886

Severity: medium (CVSS 6.8 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.1% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2007-09-14 · updated 2026-06-16
Weakness: CWE-94

Description

Incomplete blacklist vulnerability in index.php in AuraCMS 1.x and probably 2.x allows remote attackers to execute arbitrary PHP code via a (1) UNC share pathname, or a (2) ftp, (3) ftps, or (4) ssh2.sftp URL, in the pilih parameter, for which PHP remote file inclusion is blocked only for http URLs.

Affected products

Auracms: 1.0, 1.1, 1.2, 1.3, 1.5, 1.6_beta (+4)

References

http://osvdb.org/40506
http://www.auracms.org/?pilih=news&aksi=lihat&id=117
https://www.exploit-db.com/exploits/4390
http://osvdb.org/40506
http://www.auracms.org/?pilih=news&aksi=lihat&id=117
https://www.exploit-db.com/exploits/4390

Get alerted when CVE-2007-4886 or the next vulnerability affects your stack