1. CVE-Search
  2. CVE-2006-5234
ID CVE-2006-5234
Summary Multiple PHP remote file inclusion vulnerabilities in phpWebSite 0.10.2 allow remote attackers to execute arbitrary PHP code via a URL in the PHPWS_SOURCE_DIR parameter in (1) init.php, (2) users.php, (3) Cookie.php, (4) forms.php, (5) Groups.php, (6) ModSetting.php, (7) Calendar.php, (8) DateTime.php, (9) core.php, (10) ImgLibrary.php, (11) Manager.php, and (12) Template.php, and (13) EZform.php. NOTE: CVE disputes this report, since "PHPWS_SOURCE_DIR" is defined as a constant, not accessed as a variable
References
Vulnerable Configurations
  • cpe:2.3:a:phpwebsite:phpwebsite:0.10.2:*:*:*:*:*:*:*
    cpe:2.3:a:phpwebsite:phpwebsite:0.10.2:*:*:*:*:*:*:*
CVSS
Base: 7.5 (as of 07-08-2024 - 20:15)
Impact:
Exploitability:
CWE NVD-CWE-Other
CAPEC
Access
VectorComplexityAuthentication
NETWORK LOW NONE
Impact
ConfidentialityIntegrityAvailability
PARTIAL PARTIAL PARTIAL
cvss-vector via4 AV:N/AC:L/Au:N/C:P/I:P/A:P
refmap via4
bid 20412
bugtraq
  • 20061009 phpWebSite 0.10.2 Remote File Include Vulnerabilities
  • 20061011 Re: phpWebSite 0.10.2 Remote File Include Vulnerabilities
sreason 1716
vim 20061010 phpWebSite 0.10.2 RFI - CVE dispute
Last major update 07-08-2024 - 20:15
Published 11-10-2006 - 01:07
Last modified 07-08-2024 - 20:15
Back to Top