CVE-2006-5432

EPSS 2.6%

Multiple direct static code injection vulnerabilities in db/txt.inc.php in phpPowerCards 2.10, when register_globals is enabled, allow remote attackers to create or overwrite arbitrary files via the (1) email[to], (2) email[from], (3) name[to], (4) name[from], (5) picture, (6) comment, or (7) sessionID parameter, as demonstrated by creating a new .php file that permits remote file inclusion, and then requesting this file.

Affected products

n/a · n/a

public PoCs found — 1

cve_referencewww.exploit-db.com/exploits/2590unverified

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →

References

http://secunia.com/advisories/22471 https://exchange.xforce.ibmcloud.com/vulnerabilities/29669 https://www.exploit-db.com/exploits/2590 http://www.osvdb.org/29840 http://www.securityfocus.com/bid/20620 http://www.vupen.com/english/advisories/2006/4105