Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.5

Zomplog admin upload page lets anyone act as admin

CVE-2007-5230 · published 19 years ago
Summary

The admin/upload_files.php page in Zomplog version 3.8.1 and earlier does not verify that a user is an administrator. As a result, anyone who knows the URL can perform admin tasks, including uploading files that could run malicious code. Apply the latest Zomplog update or block access to that page until it is patched.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
zomplog zomplog 3.7
3.7.6
3.8
3.8.1
cpe:2.3:a:zomplog:zomplog:3.7:*:*:*:*:*:*:*
Original advisory text
admin/upload_files.php in Zomplog 3.8.1 and earlier does not check for administrative credentials, which allows remote attackers to perform administrative actions via a direct request. NOTE: this ...
admin/upload_files.php in Zomplog 3.8.1 and earlier does not check for administrative credentials, which allows remote attackers to perform administrative actions via a direct request. NOTE: this can be leveraged for code execution by exploiting CVE-2007-5231.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker partial control (estimated)
Severity
7.5 High
Exploitation
5% chance of attack within 30 days
Type
CWE-264Permissions, Privileges, and Access Controls
Timeline
Published5 Oct 2007
Updated30 Oct 2026
First seen29 Sep 2026
Sources
CVE-2007-5230 · NVD
Track software like this
Free during beta