CVE:CVE-2007-6147
CNNVD:CNNVD-200711-371
IAPR COMMENCE中存在多个PHP远程文件包含漏洞，远程攻击者借助(a) php_root_path以及(b)(1) admin/includes/, (2) admin/phase/, (3) includes/, (4) includes/page_includes/, (5) reviewer/includes/, (6) reviewer/phase/,以及(7) user/phase/下的不同PHP脚本的privilege_root_path参数的一个URL执行任意PHP代码。
solution:Upgrade iaprcommence iapr_commence to a higher version than 1.3,and avoid the version 1.3