CVE-2007-2167 EXPLOIT
7.5
HIGH · CVSS 2.0 · EPSS 44.4% (pctl 99)
Patch early
A public exploit exists.
Description
Static code injection vulnerability in process.php in AimStats 3.2 allows remote attackers to inject PHP code into config.php via the number parameter in an update action.
Scoring
| CVSS | 7.5 (HIGH, v2.0) |
|---|---|
| Vector | AV:N/AC:L/Au:N/C:P/I:P/A:P |
| EPSS | 44.43% — more likely to be exploited than 99% of all CVEs |
| On CISA KEV | no |
| Public exploit | yes |
| Published | 2007-04-22 |
| Last modified | 2026-06-16 |
Affected (1)
| Vendor | Product |
|---|---|
| aimstats | aimstats |
Public exploits
| Source | Title | Date |
|---|---|---|
| exploit-db | AimStats 3.2 - 'process.php?update' Remote Code Execution | 2007-04-18 |
References
- http://secunia.com/advisories/24955
- http://www.securityfocus.com/bid/23573
- http://www.vupen.com/english/advisories/2007/1447
- http://www.x-pose.org/aimstats.php
- https://exchange.xforce.ibmcloud.com/vulnerabilities/33742
- https://www.exploit-db.com/exploits/3762
- http://secunia.com/advisories/24955
- http://www.securityfocus.com/bid/23573
- http://www.vupen.com/english/advisories/2007/1447
- http://www.x-pose.org/aimstats.php
- https://exchange.xforce.ibmcloud.com/vulnerabilities/33742
- https://www.exploit-db.com/exploits/3762
→ the Explorer · watch your stack · NVD