CVE-2006-2852 - Vulnerability Details - OpenCVE

PHP remote file inclusion vulnerability in dotWidget CMS 1.0.6 and earlier, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the file_path parameter in (1) index.php, (2) feedback.php, and (3) printfriendly.php.

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

Access Vector Network

Access Complexity Medium

Authentication None

Confidentiality Impact Partial

Integrity Impact Partial

Availability Impact Partial

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Dotwidget	Dotwidget Cms

Configuration 1 [-]

cpe:2.3:a:dotwidget:dotwidget_cms:1.0.6:*:*:*:*:*:*:*

No data.

References

Link	Providers
http://secunia.com/advisories/20463
http://securityreason.com/securityalert/1045
http://securitytracker.com/id?1016220
http://www.majorsecurity.de/advisory/major_rls7.txt
http://www.osvdb.org/25981
http://www.osvdb.org/25983
http://www.osvdb.org/displayvuln.php?osvdb_id=25982
http://www.securityfocus.com/archive/1/435870/100/0/threaded
http://www.securityfocus.com/bid/18258
http://www.vupen.com/english/advisories/2006/2141
https://exchange.xforce.ibmcloud.com/vulnerabilities/26918

History

No history.

MITRE

Status: PUBLISHED

Assigner: mitre

Published: 2006-06-06T20:03:00

Updated: 2024-08-07T18:06:26.961Z

Reserved: 2006-06-05T00:00:00

Link: CVE-2006-2852

Vulnrichment

No data.

NVD

Status : Modified

Published: 2006-06-06T20:06:00.000

Modified: 2024-11-21T00:12:14.683

Link: CVE-2006-2852

Redhat

No data.

{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "datePublic": "2006-06-02T00:00:00", "descriptions": [{"lang": "en", "value": "PHP remote file inclusion vulnerability in dotWidget CMS 1.0.6 and earlier, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the file_path parameter in (1) index.php, (2) feedback.php, and (3) printfriendly.php."}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2018-10-18T14:57:01", "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre"}, "references": [{"tags": ["x_refsource_MISC"], "url": "http://www.majorsecurity.de/advisory/major_rls7.txt"}, {"name": "dotwidget-filepath-file-include(26918)", "tags": ["vdb-entry", "x_refsource_XF"], "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/26918"}, {"name": "25982", "tags": ["vdb-entry", "x_refsource_OSVDB"], "url": "http://www.osvdb.org/displayvuln.php?osvdb_id=25982"}, {"name": "1016220", "tags": ["vdb-entry", "x_refsource_SECTRACK"], "url": "http://securitytracker.com/id?1016220"}, {"name": "1045", "tags": ["third-party-advisory", "x_refsource_SREASON"], "url": "http://securityreason.com/securityalert/1045"}, {"name": "ADV-2006-2141", "tags": ["vdb-entry", "x_refsource_VUPEN"], "url": "http://www.vupen.com/english/advisories/2006/2141"}, {"name": "25981", "tags": ["vdb-entry", "x_refsource_OSVDB"], "url": "http://www.osvdb.org/25981"}, {"name": "20463", "tags": ["third-party-advisory", "x_refsource_SECUNIA"], "url": "http://secunia.com/advisories/20463"}, {"name": "25983", "tags": ["vdb-entry", "x_refsource_OSVDB"], "url": "http://www.osvdb.org/25983"}, {"name": "20060603 [MajorSecurity #7]dotWidget CMS <= 1.0.6 - Remote File Include Vulnerability", "tags": ["mailing-list", "x_refsource_BUGTRAQ"], "url": "http://www.securityfocus.com/archive/1/435870/100/0/threaded"}, {"name": "18258", "tags": ["vdb-entry", "x_refsource_BID"], "url": "http://www.securityfocus.com/bid/18258"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "cve@mitre.org", "ID": "CVE-2006-2852", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "PHP remote file inclusion vulnerability in dotWidget CMS 1.0.6 and earlier, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the file_path parameter in (1) index.php, (2) feedback.php, and (3) printfriendly.php."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "http://www.majorsecurity.de/advisory/major_rls7.txt", "refsource": "MISC", "url": "http://www.majorsecurity.de/advisory/major_rls7.txt"}, {"name": "dotwidget-filepath-file-include(26918)", "refsource": "XF", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/26918"}, {"name": "25982", "refsource": "OSVDB", "url": "http://www.osvdb.org/displayvuln.php?osvdb_id=25982"}, {"name": "1016220", "refsource": "SECTRACK", "url": "http://securitytracker.com/id?1016220"}, {"name": "1045", "refsource": "SREASON", "url": "http://securityreason.com/securityalert/1045"}, {"name": "ADV-2006-2141", "refsource": "VUPEN", "url": "http://www.vupen.com/english/advisories/2006/2141"}, {"name": "25981", "refsource": "OSVDB", "url": "http://www.osvdb.org/25981"}, {"name": "20463", "refsource": "SECUNIA", "url": "http://secunia.com/advisories/20463"}, {"name": "25983", "refsource": "OSVDB", "url": "http://www.osvdb.org/25983"}, {"name": "20060603 [MajorSecurity #7]dotWidget CMS <= 1.0.6 - Remote File Include Vulnerability", "refsource": "BUGTRAQ", "url": "http://www.securityfocus.com/archive/1/435870/100/0/threaded"}, {"name": "18258", "refsource": "BID", "url": "http://www.securityfocus.com/bid/18258"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-07T18:06:26.961Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_MISC", "x_transferred"], "url": "http://www.majorsecurity.de/advisory/major_rls7.txt"}, {"name": "dotwidget-filepath-file-include(26918)", "tags": ["vdb-entry", "x_refsource_XF", "x_transferred"], "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/26918"}, {"name": "25982", "tags": ["vdb-entry", "x_refsource_OSVDB", "x_transferred"], "url": "http://www.osvdb.org/displayvuln.php?osvdb_id=25982"}, {"name": "1016220", "tags": ["vdb-entry", "x_refsource_SECTRACK", "x_transferred"], "url": "http://securitytracker.com/id?1016220"}, {"name": "1045", "tags": ["third-party-advisory", "x_refsource_SREASON", "x_transferred"], "url": "http://securityreason.com/securityalert/1045"}, {"name": "ADV-2006-2141", "tags": ["vdb-entry", "x_refsource_VUPEN", "x_transferred"], "url": "http://www.vupen.com/english/advisories/2006/2141"}, {"name": "25981", "tags": ["vdb-entry", "x_refsource_OSVDB", "x_transferred"], "url": "http://www.osvdb.org/25981"}, {"name": "20463", "tags": ["third-party-advisory", "x_refsource_SECUNIA", "x_transferred"], "url": "http://secunia.com/advisories/20463"}, {"name": "25983", "tags": ["vdb-entry", "x_refsource_OSVDB", "x_transferred"], "url": "http://www.osvdb.org/25983"}, {"name": "20060603 [MajorSecurity #7]dotWidget CMS <= 1.0.6 - Remote File Include Vulnerability", "tags": ["mailing-list", "x_refsource_BUGTRAQ", "x_transferred"], "url": "http://www.securityfocus.com/archive/1/435870/100/0/threaded"}, {"name": "18258", "tags": ["vdb-entry", "x_refsource_BID", "x_transferred"], "url": "http://www.securityfocus.com/bid/18258"}]}]}, "cveMetadata": {"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "cveId": "CVE-2006-2852", "datePublished": "2006-06-06T20:03:00", "dateReserved": "2006-06-05T00:00:00", "dateUpdated": "2024-08-07T18:06:26.961Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:dotwidget:dotwidget_cms:1.0.6:*:*:*:*:*:*:*", "matchCriteriaId": "33A76B77-953C-4886-B12C-B9B490DDA3E1", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "PHP remote file inclusion vulnerability in dotWidget CMS 1.0.6 and earlier, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the file_path parameter in (1) index.php, (2) feedback.php, and (3) printfriendly.php."}], "id": "CVE-2006-2852", "lastModified": "2024-11-21T00:12:14.683", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 6.8, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 8.6, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": true, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}]}, "published": "2006-06-06T20:06:00.000", "references": [{"source": "cve@mitre.org", "tags": ["Vendor Advisory"], "url": "http://secunia.com/advisories/20463"}, {"source": "cve@mitre.org", "url": "http://securityreason.com/securityalert/1045"}, {"source": "cve@mitre.org", "url": "http://securitytracker.com/id?1016220"}, {"source": "cve@mitre.org", "tags": ["Exploit"], "url": "http://www.majorsecurity.de/advisory/major_rls7.txt"}, {"source": "cve@mitre.org", "url": "http://www.osvdb.org/25981"}, {"source": "cve@mitre.org", "url": "http://www.osvdb.org/25983"}, {"source": "cve@mitre.org", "url": "http://www.osvdb.org/displayvuln.php?osvdb_id=25982"}, {"source": "cve@mitre.org", "url": "http://www.securityfocus.com/archive/1/435870/100/0/threaded"}, {"source": "cve@mitre.org", "tags": ["Exploit"], "url": "http://www.securityfocus.com/bid/18258"}, {"source": "cve@mitre.org", "url": "http://www.vupen.com/english/advisories/2006/2141"}, {"source": "cve@mitre.org", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/26918"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "http://secunia.com/advisories/20463"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://securityreason.com/securityalert/1045"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://securitytracker.com/id?1016220"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit"], "url": "http://www.majorsecurity.de/advisory/major_rls7.txt"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.osvdb.org/25981"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.osvdb.org/25983"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.osvdb.org/displayvuln.php?osvdb_id=25982"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.securityfocus.com/archive/1/435870/100/0/threaded"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit"], "url": "http://www.securityfocus.com/bid/18258"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.vupen.com/english/advisories/2006/2141"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/26918"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-94"}], "source": "nvd@nist.gov", "type": "Primary"}]}