CVE-2004-1427: Korweblog

High severity, CVSS 7.5. EPSS: 1.7% chance of exploitation in the next 30 days.

PHP remote file inclusion vulnerability in main.inc in KorWeblog 1.6.2-cvs and earlier allows remote attackers to execute arbitrary PHP code by modifying the G_PATH parameter to reference a URL on a remote web server that contains the code, as demonstrated in index.php when using .. (dot dot) sequences in the lng parameter to cause main.inc to be loaded.

Affected products

• Korweblog Korweblog: version 1.6.1 only; version 1.6.2cvs only

Published 2004-12-31. Last modified 2026-06-16.