CVE-2006-5432 : Multiple direct static code injection vulnerabilities in db/txt.inc.php in phpPowerCards 2.10, when register

Multiple direct static code injection vulnerabilities in db/txt.inc.php in phpPowerCards 2.10, when register_globals is enabled, allow remote attackers to create or overwrite arbitrary files via the (1) email[to], (2) email[from], (3) name[to], (4) name[from], (5) picture, (6) comment, or (7) sessionID parameter, as demonstrated by creating a new .php file that permits remote file inclusion, and then requesting this file.

Published 2006-10-20 23:07:00

Updated 2017-10-19 01:29:35

Source MITRE

View at NVD, CVE.org

Vulnerability category: File inclusion

Exploit prediction scoring system (EPSS) score for CVE-2006-5432

EPSS FAQ

6.17%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 93 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2006-5432

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source	First Seen
2.6	LOW	AV:N/AC:H/Au:N/C:N/I:P/A:N	4.9	2.9	NIST
Access Vector: Network Access Complexity: High Authentication: None Confidentiality Impact: None Integrity Impact: Partial Availability Impact: None

Products affected by CVE-2006-5432

Marc Giombetti » Phppowercards » Version: 2.10
cpe:2.3:a:marc_giombetti:phppowercards:2.10:*:*:*:*:*:*:*
Matching versions

Vulnerability Details : CVE-2006-5432

Exploit prediction scoring system (EPSS) score for CVE-2006-5432

CVSS scores for CVE-2006-5432

References for CVE-2006-5432

Products affected by CVE-2006-5432