CVE-2006-2149

EPSS 7.7%

PHP remote file inclusion vulnerability in sources/lostpw.php in Aardvark Topsites PHP 4.2.2 and earlier, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via the CONFIG[path] parameter, as demonstrated by including a GIF that contains PHP code.

Affected products

n/a · n/a

public PoCs found — 1

cve_referencewww.exploit-db.com/exploits/1732unverified

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →

References

http://secunia.com/advisories/19911 https://exchange.xforce.ibmcloud.com/vulnerabilities/26189 https://www.exploit-db.com/exploits/1732 http://www.osvdb.org/25158 http://www.securityfocus.com/bid/17940 http://www.vupen.com/english/advisories/2006/1587