Back to CVE Browser

CVE-2007-2776

CRITICAL

10.0

CVSS Severity Score

EPSS Score0.1990%

EPSS Percentile15.84th

PublishedMay 21, 2007

Last ModifiedApr 23, 2026

Vulnerability Description

AlstraSoft Template Seller Pro 3.25 and earlier sends a redirect to the web browser but does not exit when administrative credentials are missing, which allows remote attackers to inject a credential variable setting and obtain administrative access via a direct request to admin/changeinfo.php.

Affected Platforms (CPE)

📦

Alstrasoft

Template Seller

<= 3.25

References & Advisories

🔗 http://itablackhawk.altervista.org/exploit/alsoft_exploit_pack

🔗 http://osvdb.org/40422

🔗 http://www.securityfocus.com/bid/24068

🔗 https://exchange.xforce.ibmcloud.com/vulnerabilities/34396

🔗 https://www.exploit-db.com/exploits/3958

🔗 http://itablackhawk.altervista.org/exploit/alsoft_exploit_pack

🔗 http://osvdb.org/40422

🔗 http://www.securityfocus.com/bid/24068

Related Vulnerabilities

CVE-2005-37977.5

PHP remote file inclusion vulnerability in payment_paypal.php in AlstraSoft Template Seller Pro 3.25 allows remote attackers to ex...

CVE-2005-37987.5

SQL injection vulnerability in admin/index.php in AlstraSoft Template Seller Pro 3.25 allows remote attackers to execute arbitrary...

CVE-2006-45917.5

Multiple PHP remote file inclusion vulnerabilities in AlstraSoft Template Seller, and possibly AltraSoft Template Seller Pro 3.25,...

CVE-2007-27777.5

Unrestricted file upload vulnerability in admin/addsptemplate.php in AlstraSoft Template Seller Pro 3.25 and earlier allows remote...