Vulnerability Details : CVE-2006-1551

Eval injection vulnerability in pajax_call_dispatcher.php in PAJAX 0.5.1 and earlier allows remote attackers to execute arbitrary code via the (1) $method and (2) $args parameters.

Vulnerability category: Execute code

Published 2006-04-13 22:02:00

Updated 2018-10-18 16:33:25

Source MITRE

View at NVD, CVE.org

At least one public exploit which can be used to exploit this vulnerability exists!

Exploit prediction scoring system (EPSS) score for CVE-2006-1551

Probability of exploitation activity in the next 30 days: 82.60%

Percentile, the proportion of vulnerabilities that are scored at or less: ~ 98 % EPSS Score History EPSS FAQ

Metasploit modules for CVE-2006-1551

PAJAX Remote Command Execution

Disclosure Date : 2006-03-30

exploit/unix/webapp/pajax_remote_exec

RedTeam has identified two security flaws in PAJAX (<= 0.5.1). It is possible to execute arbitrary PHP code from unchecked user input. Additionally, it is possible to include arbitrary files on the server ending in ".class.php". Authors: - Matteo Cantoni <[email protected]> - hdm <[email protected]>

More information

CVSS scores for CVE-2006-1551

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Source
7.5	HIGH	AV:N/AC:L/Au:N/C:P/I:P/A:P	10.0	6.4	[email protected]
Access Vector: Network Access Complexity: Low Authentication: None Confidentiality Impact: Partial Integrity Impact: Partial Availability Impact: Partial

References for CVE-2006-1551

Products affected by CVE-2006-1551