$ cve CVE-2007-2199 JSON

CVE-2007-2199 EXPLOIT

6.8

MEDIUM · CVSS 2.0 · EPSS 46.9% (pctl 99)

Patch early

A public exploit exists.

Description

PHP remote file inclusion vulnerability in lib/pcltar.lib.php (aka pcltar.php) in the PclTar module 1.3 and 1.3.1 for Vincent Blavet PhpConcept Library, as used in multiple products including (1) Joomla! 1.5.0 Beta, (2) N/X Web Content Management System (WCMS) 4.5, (3) CJG EXPLORER PRO 3.3, and (4) phpSiteBackup 0.1, allows remote attackers to execute arbitrary PHP code via a URL in the g_pcltar_lib_dir parameter.

Scoring

CVSS	6.8 (MEDIUM, v2.0)
Vector	AV:N/AC:M/Au:N/C:P/I:P/A:P
EPSS	46.91% — more likely to be exploited than 99% of all CVEs
Weakness	CWE-94
On CISA KEV	no
Public exploit	yes
Published	2007-04-24
Last modified	2026-06-16

Affected (4)

Vendor	Product
cjg explorer pro	cjg explorer pro
joomla	joomla
nx	n x wcms
phpsitebackup	phpsitebackup

Public exploits

Source	Title	Date
exploit-db	PHPSiteBackup 0.1 - 'pcltar.lib.php' Remote File Inclusion	2007-06-26
exploit-db	CJG EXPLORER PRO 3.2 - 'g_pcltar_lib_dir' Remote File Inclusion	2007-05-13
exploit-db	Joomla! 1.5.0 Beta - 'pcltar.php' Remote File Inclusion	2007-04-23

References

→ the Explorer · watch your stack · NVD