CVE-2007-2670

medium

Description

PHPChain 1.0 and earlier allows remote attackers to obtain the installation path via invalid values of the catid parameter to (1) settings.php or (2) cat.php, as demonstrated by XSS manipulations.

References

https://exchange.xforce.ibmcloud.com/vulnerabilities/34019

http://www.vupen.com/english/advisories/2007/1647

http://www.securityfocus.com/bid/23761

http://secunia.com/advisories/25128

http://pridels0.blogspot.com/2007/05/phpchain-vuln.html

http://osvdb.org/35538

Details

Source: Mitre, NVD

Published: 2007-05-14

Updated: 2026-06-16

Risk Information

CVSS v2

Base Score: 4.3

Vector: CVSS2#AV:N/AC:M/Au:N/C:N/I:P/A:N

Severity: Medium

CVSS v3

Base Score: 6.1

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N