$ cve CVE-2007-1472 JSON

CVE-2007-1472 EXPLOIT

6.8

MEDIUM · CVSS 2.0 · EPSS 3.4% (pctl 88)

Patch early

A public exploit exists.

Description

Variable overwrite vulnerability in groupit/base/groupit.start.inc in Groupit 2.00b5 allows remote attackers to conduct remote file inclusion attacks and execute arbitrary PHP code via arguments that are written to $_GLOBALS, as demonstrated using a URL in the c_basepath parameter to (1) content.php, (2) userprofile.php, (3) password.php, (4) dispatch.php, and (5) deliver.php in html/, and possibly (6) load.inc.php and related files.

Scoring

CVSS	6.8 (MEDIUM, v2.0)
Vector	AV:N/AC:M/Au:N/C:P/I:P/A:P
EPSS	3.39% — more likely to be exploited than 88% of all CVEs
Weakness	CWE-94
On CISA KEV	no
Public exploit	yes
Published	2007-03-16
Last modified	2026-06-16

Affected (1)

Vendor	Product
t-systems solutions for research gmbh	groupit

Public exploits

Source	Title	Date
exploit-db	Groupit 2.00b5 - 'c_basepath' Remote File Inclusion	2007-03-15

References

→ the Explorer · watch your stack · NVD