Vulnerability Details : CVE-2006-5234
Multiple PHP remote file inclusion vulnerabilities in phpWebSite 0.10.2 allow remote attackers to execute arbitrary PHP code via a URL in the PHPWS_SOURCE_DIR parameter in (1) init.php, (2) users.php, (3) Cookie.php, (4) forms.php, (5) Groups.php, (6) ModSetting.php, (7) Calendar.php, (8) DateTime.php, (9) core.php, (10) ImgLibrary.php, (11) Manager.php, and (12) Template.php, and (13) EZform.php. NOTE: CVE disputes this report, since "PHPWS_SOURCE_DIR" is defined as a constant, not accessed as a variable
Vulnerability category: File inclusion
Products affected by CVE-2006-5234
- cpe:2.3:a:phpwebsite:phpwebsite:0.10.2:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2006-5234
9.59%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 94 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2006-5234
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
7.5
|
HIGH | AV:N/AC:L/Au:N/C:P/I:P/A:P |
10.0
|
6.4
|
NIST |
References for CVE-2006-5234
-
http://www.securityfocus.com/bid/20412
Exploit
-
http://www.securityfocus.com/archive/1/448098/100/0/threaded
-
http://www.attrition.org/pipermail/vim/2006-October/001079.html
[VIM] phpWebSite 0.10.2 RFI - CVE disputeExploit
-
http://securityreason.com/securityalert/1716
phpWebSite 0.10.2 Remote File Include Vulnerabilities - CXSecurity.com
-
http://www.securityfocus.com/archive/1/448307/100/100/threaded
Jump to