CVE-2007-1628 describes multiple remote file inclusion vulnerabilities in Study planner (Studiewijzer) version 0.15 and earlier. These flaws allow unauthenticated remote attackers to execute arbitrary PHP code by injecting a malicious URL into the SPL_CFG[dirroot] parameter across various application files, provided the register_globals setting is enabled. This vulnerability carries a critical CVSS score of 9.3, indicating a high severity. The attack vector is network-based with medium attack complexity, requiring no authentication. Successful exploitation grants complete confidentiality, integrity, and availability impact to the affected system. While not listed on the CISA KEV catalog, public exploit code (EDB-3532) is available, suggesting potential for exploitation. Despite this, there is no evidence of active exploitation, and community discussion or media coverage for this CVE is minimal.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
0.13CPE matchmatch criteria | cpe:2.3:a:studiewijzer:studiewijzer:0.13:*:*:*:*:*:*:* | ||
0.14CPE matchmatch criteria | cpe:2.3:a:studiewijzer:studiewijzer:0.14:*:*:*:*:*:*:* | ||
0.15CPE matchmatch criteria | cpe:2.3:a:studiewijzer:studiewijzer:0.15:*:*:*:*:*:*:* |
CVSS version used by this source: 2.0
AV:N/AC:M/Au:N/C:C/I:C/A:C
No social media mentions found for this CVE.
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.1 Bluesky, 0.1 Mastodon, and 0.2 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.