CVE-2006-6634

EPSS 2.6%

Multiple PHP remote file inclusion vulnerabilities in the ExtCalThai (com_extcalendar) 0.9.1 and earlier component for Mambo allow remote attackers to execute arbitrary PHP code via a URL in (1) the CONFIG_EXT[LANGUAGES_DIR] parameter to admin_events.php, (2) the mosConfig_absolute_path parameter to extcalendar.php, or (3) the CONFIG_EXT[LIB_DIR] parameter to lib/mail.inc.php.

Affected products

n/a · n/a

public PoCs found — 2

exploitdbwww.exploit-db.com/exploits/28792unverified exploitdbwww.exploit-db.com/exploits/28793unverified

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →

References

http://archives.neohapsis.com/archives/bugtraq/2006-10/0179.html http://securityreason.com/securityalert/2041 https://exchange.xforce.ibmcloud.com/vulnerabilities/29499 http://www.securityfocus.com/bid/20487