CVE:CVE-2007-5631
CNNVD:CNNVD-200710-460
PeopleAggregator 1.2pre6版本中存在多个PHP远程文件包含漏洞。远程攻击者可以借助对(1) AudiosMediaGalleryModule/AudiosMediaGalleryModule.php, (2) ImagesMediaGalleryModule/ImagesMediaGalleryModule.php, (3) MembersFacewallModule/MembersFacewallModule.php, (4) NewestGroupsModule/NewestGroupsModule.php, (5) UploadMediaModule/UploadMediaModule.php, 和(6) BetaBlockModules/的VideosMediaGalleryModule/VideosMediaGalleryModule.php的current_blockmodule_path参数; 和(7) 对不同组件的path_prefix 参数中的一个URL，执行任意PHP代码。
solution:Upgrade peopleaggregator peopleaggregator to a higher version than 1.2pre6,and avoid the version 1.2pre6