CVE-2006-4428

CVSS 9.8 CRITICALEPSS 4.3%

PHP remote file inclusion vulnerability in index.php in Jupiter CMS 1.1.5 allows remote attackers to execute arbitrary PHP code via a URL in the template parameter. NOTE: CVE disputes this claim, since the $template variable is defined as a static value before it is referenced in an include statement

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

n/a · n/a

public PoCs found — 1

exploitdbwww.exploit-db.com/exploits/28430unverified

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →

References

https://exchange.xforce.ibmcloud.com/vulnerabilities/28589 http://www.attrition.org/pipermail/vim/2006-August/000996.html http://www.osvdb.org/28298 http://www.securityfocus.com/archive/1/444421/100/0/threaded http://www.securityfocus.com/archive/1/444729/100/0/threaded http://www.securityfocus.com/bid/19721