CVE-2006-4448 - Multiple PHP remote file inclusion vulnerabilities in interact 2.2, when register_globals is enabled

CVE-2006-4448

Summary

Multiple PHP remote file inclusion vulnerabilities in interact 2.2, when register_globals is enabled, allow remote attackers to execute arbitrary PHP code via a URL in the (1) CONFIG[BASE_PATH] parameter in (a) admin/autoprompter.php and (b) includes/common.inc.php, and the (2) CONFIG[LANGUAGE_CPATH] parameter in (c) admin/autoprompter.php.

References

Vulnerable Configurations

cpe:2.3:a:interact_learning_community_environment:interact:2.2:*:*:*:*:*:*:*
cpe:2.3:a:interact_learning_community_environment:interact:2.2:*:*:*:*:*:*:*

CVSS

Base:	5.1 (as of 17-10-2018 - 21:37)
Impact:
Exploitability:

CWE

NVD-CWE-Other

CAPEC

Access

Vector	Complexity	Authentication
NETWORK	HIGH	NONE

Impact

Confidentiality	Integrity	Availability
PARTIAL	PARTIAL	PARTIAL

cvss-vector via4

AV:N/AC:H/Au:N/C:P/I:P/A:P

refmap via4

bid	19739
bugtraq	20060828 interact <= 2.2 (CONFIG[BASE_PATH]) Remote File Include Vulnerability
exploit-db	2218
sreason	1471
xf	interact-autoprompter-file-include(28485)

Last major update

17-10-2018 - 21:37

Published

30-08-2006 - 01:04

Last modified

17-10-2018 - 21:37