CVE-2007-5223

Estado: ModificadaMedia (6.8)—

Multiple unspecified vulnerabilities in AlstraSoft Affiliate Network Pro allow remote attackers to include local files and have other unspecified impact, related to incorrect input validation or other defects involving (1) admin/backupstart.php, (2) a .sql filename under admin/admin/dump/, (3) a .sql filename in the fl parameter to admin/downloadbackup.php, and (4) a .. (dot dot) in the fl parameter to admin/downloadbackup.php.

CVSS

Versión: 2.0
Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P
Puntuación base: 6.8

Probabilidad de explotación (EPSS)

Probabilidad de explotación en los próximos 30 días: 1.42%
Percentil entre todas las CVEs puntuadas: 72
Fecha de la puntuación: 6/10/2026

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Alstrasoft — Affiliate Network PRO

CWE

CWE-264

Referencias

JSON original (NVD)

Mostrar

{
  "id": "CVE-2007-5223",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 6.8,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 6.4,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8.6,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": true,
        "userInteractionRequired": false
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2007-10-05T00:17:00.000",
  "references": [
    {
      "url": "http://osvdb.org/42342",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://osvdb.org/42343",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://osvdb.org/42344",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://securityreason.com/securityalert/3191",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.securityfocus.com/archive/1/481206/100/0/threaded",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.securityfocus.com/bid/25882",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.vupen.com/english/advisories/2007/3344",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://osvdb.org/42342",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://osvdb.org/42343",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://osvdb.org/42344",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://securityreason.com/securityalert/3191",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securityfocus.com/archive/1/481206/100/0/threaded",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securityfocus.com/bid/25882",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.vupen.com/english/advisories/2007/3344",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-264"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Multiple unspecified vulnerabilities in AlstraSoft Affiliate Network Pro allow remote attackers to include local files and have other unspecified impact, related to incorrect input validation or other defects involving (1) admin/backupstart.php, (2) a .sql filename under admin/admin/dump/, (3) a .sql filename in the fl parameter to admin/downloadbackup.php, and (4) a .. (dot dot) in the fl parameter to admin/downloadbackup.php."
    },
    {
      "lang": "es",
      "value": "Múltiples vulnerabilidades no específicas en AlstraSoft Affiliate Network Pro permite a atacantes remotos incluir archivos locales y tener otro impacto no especificado, relacionado con la validación de entrada incorrecta u otros defectos afectando a 1) admin/backupstart.php, (2) un nombre de archivo .sql bajo admin/admin/dump/, (3) un nombre de archivo .sql en el parámetro fl en admin/downloadbackup.php, y (4) una secuencia  .. (punto punto) en el parámetro fl en admin/downloadbackup.php."
    }
  ],
  "lastModified": "2026-06-16T22:45:40.640",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:alstrasoft:affiliate_network_pro:8.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C93CC628-D066-42C8-9662-666BDE7B5BBF"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}