CVEvulnerability
CVE-2006-1819
7.5 HIGH
Official page ↗
- Status
- Modified
- Published
- 2006-04-18
- Last modified
- 2026-06-16
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 7.5 HIGH — AV:N/AC:L/Au:N/C:P/I:P/A:P
Description
Directory traversal vulnerability in the loadConfig function in index.php in phpWebSite 0.10.2 and earlier allows remote attackers to include arbitrary local files and execute arbitrary PHP code via the hub_dir parameter, as demonstrated by including access_log. NOTE: in some cases, arbitrary remote file inclusion could be performed under PHP 5 using an SMB share argument such as "\\systemname\sharename".
Affected configurations
• phpwebsite phpwebsite (<= 0.10.2)
References
- http://downloads.securityfocus.com/vulnerabilities/exploits/PHPWebSite_fi_poc downloads.securityfocus.com
- http://secunia.com/advisories/19647 secunia.com
- http://secunia.com/advisories/19914 secunia.com
- http://securitytracker.com/id?1015942 securitytracker.com
- http://www.gentoo.org/security/en/glsa/glsa-200605-04.xml www.gentoo.org
- http://www.securityfocus.com/bid/17521 Exploit
- http://www.vupen.com/english/advisories/2006/1361 www.vupen.com
- https://exchange.xforce.ibmcloud.com/vulnerabilities/25867 exchange.xforce.ibmcloud.com
- https://www.exploit-db.com/exploits/1673 www.exploit-db.com
- http://downloads.securityfocus.com/vulnerabilities/exploits/PHPWebSite_fi_poc downloads.securityfocus.com
- http://secunia.com/advisories/19647 secunia.com
- http://secunia.com/advisories/19914 secunia.com
- http://securitytracker.com/id?1015942 securitytracker.com
- http://www.gentoo.org/security/en/glsa/glsa-200605-04.xml www.gentoo.org
- http://www.securityfocus.com/bid/17521 Exploit
- http://www.vupen.com/english/advisories/2006/1361 www.vupen.com
- https://exchange.xforce.ibmcloud.com/vulnerabilities/25867 exchange.xforce.ibmcloud.com
- https://www.exploit-db.com/exploits/1673 www.exploit-db.com