Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.5

gnu_edu 1.3b2 allows attackers to run code via URL

CVE-2007-2609 · published 19 years ago
Summary

The gnu_edu 1.3b2 web application lets a remote user supply a web address that the system will load as part of its code. This can let an attacker make the server execute any PHP commands they choose, potentially compromising data and services. Upgrade to a patched version or apply the vendor's recommended configuration changes as soon as possible.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
gnuedu gnu_edu 1.3b2
cpe:2.3:a:gnuedu:gnu_edu:1.3b2:*:*:*:*:*:*:*
Original advisory text
Multiple PHP remote file inclusion vulnerabilities in gnuedu 1.3b2 allow remote attackers to execute arbitrary PHP code via a URL in the (a) ETCDIR parameter to (1) libs/lom.php; (2) lom_update.php...
Multiple PHP remote file inclusion vulnerabilities in gnuedu 1.3b2 allow remote attackers to execute arbitrary PHP code via a URL in the (a) ETCDIR parameter to (1) libs/lom.php; (2) lom_update.php, (3) check-lom.php, and (4) weigh_keywords.php in scripts/; the (b) LIBSDIR parameter to (5) logout.php, (6) help.php, (7) index.php, (8) login.php; and the ETCDIR parameter to (9) web/lom.php.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker partial control (estimated)
Severity
7.5 High
Exploitation
10% chance of attack within 30 days
Type
CWE-94Code Injection
Timeline
Published11 May 2007
Updated15 Oct 2026
First seen29 Sep 2026
Sources
CVE-2007-2609 · NVD
Track software like this
Free during beta