Login Request a demo
Unscored severity · published Jul 25, 2006
CVE-2006-3850
PHP remote file inclusion vulnerability in upgrader.php in Vanilla CMS 1.0.1 and earlier, when /conf/old_settings.php exists, allows remote attackers to execute arbitrary PHP code…
–
CVSS
3.4%
EPSS
No
On KEV
Description
PHP remote file inclusion vulnerability in upgrader.php in Vanilla CMS 1.0.1 and earlier, when /conf/old_settings.php exists, allows remote attackers to execute arbitrary PHP code via a URL in the RootDirectory parameter. NOTE: this issue has been disputed by a third party who states that the RootDirectory parameter is initialized before being used, for version 1.0. CVE analysis concurs with the dispute, but it is unclear whether older versions are affected
Exploitation
Is it being used?
Exploit prediction (EPSS)3.4% · higher than 89% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
VA
Vanilla · Lussumo
through 1.0.1 · source: NVD
Affected product
VA
Vanilla
Lussumo
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2006-3850
CVE.org
https://www.cve.org/CVERecord?id=CVE-2006-3850
securityreason.com
http://securityreason.com/securityalert/1281
securitytracker.com
http://securitytracker.com/id?1016568
www.attrition.org
http://www.attrition.org/pipermail/vim/2006-July/000937.html
www.attrition.org
http://www.attrition.org/pipermail/vim/2006-July/000944.html
www.osvdb.org
http://www.osvdb.org/28287
www.securityfocus.com
http://www.securityfocus.com/archive/1/440938/100/0/threaded
More from Vanilla
–
CVE-2010-1337
Multiple PHP remote file inclusion vulnerabilities in definitions.php in Lussumo Vanilla 1.1.10, and possibly 0.9.2 and other versions, allow remote attackers to execute arbitrary…
–
CVE-2009-1845
Cross-site scripting (XSS) vulnerability in ajax/updatecheck.php in Lussumo Vanilla 1.1.5 and 1.1.7 allows remote attackers to inject arbitrary web script or HTML via the…
–
CVE-2008-3874
Cross-site scripting (XSS) vulnerability in account.php in Lussumo Vanilla 1.1.5-rc1, 1.1.4, and earlier allows remote authenticated users to inject arbitrary web script or HTML…
–
CVE-2008-3759
Cross-site request forgery (CSRF) vulnerability in ajax/UpdateCheck.php in Vanilla 1.1.4 and earlier has unknown impact and remote attack vectors
–
CVE-2008-3758
Multiple cross-site scripting (XSS) vulnerabilities in Lussumo Vanilla 1.1.4 and earlier (1) allow remote attackers to inject arbitrary web script or HTML via the NewPassword…