CVE-2006-5250 - PHP remote file inclusion vulnerability in lib/googlesearch/GoogleSearch.php in BlueShoes 4.6_public

CVE-2006-5250

Summary

PHP remote file inclusion vulnerability in lib/googlesearch/GoogleSearch.php in BlueShoes 4.6_public and earlier allows remote attackers to execute arbitrary PHP code via a URL in the APP[path][lib] parameter, a different vector than CVE-2006-2864. The following conditions must be met in order for this vulnerability to be exploited: 1) BlueShoes is installed in the webroot (really not recommended, see installation manual 2) register_globals is on (really really not recommended, off by default since php 4.2.0, read http://www.php.net/register_globals 3) allow_url_fopen is on (on by default, often set to off by hosting providers)

References

Vulnerable Configurations

cpe:2.3:a:blueshoes:blueshoes_framework:*:*:*:*:*:*:*:*
cpe:2.3:a:blueshoes:blueshoes_framework:*:*:*:*:*:*:*:*

CVSS

Base:	5.1 (as of 17-10-2018 - 21:41)
Impact:
Exploitability:

CWE

NVD-CWE-Other

CAPEC

Access

Vector	Complexity	Authentication
NETWORK	HIGH	NONE

Impact

Confidentiality	Integrity	Availability
PARTIAL	PARTIAL	PARTIAL

cvss-vector via4

AV:N/AC:H/Au:N/C:P/I:P/A:P

refmap via4

bid	20450
bugtraq	20061010 blueshoes <= 4.6_public Remote File Inclusion
misc	http://www.blueshoes.org/en/news/
sreason	1713
xf	blueshoes-google-file-include(29429)

Last major update

17-10-2018 - 21:41

Published

12-10-2006 - 00:07

Last modified

17-10-2018 - 21:41