CVE:CVE-2007-3230
CNNVD:CNNVD-200706-245
PHP::HTML是一套HTML类，用于帮助创建复杂的文档。
PHP::HTML处理用户请求时存在输入验证漏洞，远程攻击者可能利用此漏洞在服务器上执行任意命令。
PHP::HTML的phphtml.php脚本中没有正确地验证htmlclass_path参数的输入，允许攻击者通过包含任意本地或外部资源导致执行任意代码。漏洞代码如下：
<?
define (PHPHTML_VERSION, "0.6.4");
/* gettext is not implemented for now*/
$use_gettext=0;
/* We need to know where the PHP::HTML tree is installed.*/
if (strlen(chop($htmlclass_path))==0) $htmlclass_path=".";
if ($use_gettext==1)
{
   if (function_exists("gettext"))
   {
       $gettext_enable=1;
   }
}
include("$htmlclass_path/ext.php");  /* Some extenstions to PHP */
include("$htmlclass_path/core.php");  /* PHP::HTML Core */
include("$htmlclass_path/xhtml.php");  /* XHTML extensions */
include("$htmlclass_path/xhtml_table.php");  /* XHTML tables extensions */
include("$htmlclass_path/xhtml_forms.php");  /* XHTML forms extensions */
include("$htmlclass_path/xhtml_doc.php");  /* XHTML document extension */
include("$htmlclass_path/wml.php");  /* WML extension */
成功攻击要求打开了register_globals选项。
solution:Upgrade simian_systems_inc sitellite to a higher version than 0.6.4,and avoid the version 0.6.4