CVE-2006-4423

EPSS 3.0%

Multiple PHP remote file inclusion vulnerabilities in Bigace 1.8.2 allow remote attackers to execute arbitrary PHP code via a URL in the (1) GLOBALS[_BIGACE][DIR][admin] parameter in (a) system/command/admin.cmd.php, (b) admin/include/upload_form.php, and (c) admin/include/item_main.php; and the (2) GLOBALS[_BIGACE][DIR][libs] parameter in (d) system/command/admin.cmd.php and (e) system/command/download.cmd.php.

Affected products

n/a · n/a

public PoCs found — 4

exploitdbwww.exploit-db.com/exploits/28435unverified exploitdbwww.exploit-db.com/exploits/28434unverified exploitdbwww.exploit-db.com/exploits/28432unverified exploitdbwww.exploit-db.com/exploits/28433unverified

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →

References

http://securityreason.com/securityalert/1462 http://securitytracker.com/id?1016760 https://exchange.xforce.ibmcloud.com/vulnerabilities/28585 http://www.securityfocus.com/archive/1/444415/100/0/threaded http://www.securityfocus.com/bid/19723