CVE:CVE-2007-3632
CNNVD:CNNVD-200707-136
LimeSurvey (又称PHPSurveyor) 1.49RC2版本中存在多个PHP远程文件包含漏洞。远程攻击者可以借助对(1)OLE/PPS/File.php,(2)OLE/PPS/Root.php,(3)Spreadsheet/Excel/Writer.php,或(4)admin/classes/pear/中的OLE/PPS.php;或(5)Worksheet.php,(6)Parser.php,(7)Workbook.php,(8)Format.php,或(9)admin/classes/pear/Spreadsheet/Excel/Writer/中的BIFFwriter.php的homedir参数的一个URL，执行任意PHP代码。
solution:Upgrade limesurvey limesurvey to a higher version than 1.49_rc2,and avoid the version 1.49_rc2