CVE-2007-2087 describes multiple remote file inclusion vulnerabilities in CNStats 2.12, specifically affecting the who_r.php and who_s.php scripts in the reports/ directory. This flaw allows remote attackers to execute arbitrary PHP code by injecting a malicious URL into the 'bn' parameter, provided register_globals is enabled and .htaccess is not recognized. The vulnerability carries a CVSS score of 6.8 (Medium), indicating a network-based attack with medium complexity, potentially leading to partial confidentiality, integrity, and availability compromise. While not listed in CISA KEV, an ExploitDB entry (EDB-3741) exists for a similar CNStats 2.9 vulnerability, and the CVE has garnered some community discussion and media coverage, including an article linking it to a cybercrime forum exposure.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
2.12CPE matchmatch criteria | cpe:2.3:a:cnstats:cnstats:2.12:*:*:*:*:*:*:* |
CVSS version used by this source: 2.0
AV:N/AC:M/Au:N/C:P/I:P/A:P
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.0 Bluesky, 0.0 Mastodon, and 0.2 GitHub mentions.
The average CVE in this peer group has 0.0 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.