NetSight
IP …
medium5.0Public exploit code

CVE-2005-3571

PHP file inclusion vulnerability in protection.php in CodeGrrl (a) PHPCalendar 1.0, (b) PHPClique 1.0, (c) PHPCurrently 2.0, (d) PHPFanBase 2.1, and (e) PHPQuo…

Public exploit code

Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.

Impact

PHP file inclusion vulnerability in protection.php in CodeGrrl (a) PHPCalendar 1.0, (b) PHPClique 1.0, (c) PHPCurrently 2.0, (d) PHPFanBase 2.1, and (e) PHPQuotes 1.0 allows remote attackers to include arbitrary local files via the siteurl parameter when register_globals is enabled. NOTE: It was later reported that PHPFanBase 2.2 is also affected.

Affected products

VendorProductAffected versions
CodegrrlPhpcalendar
through 1.0
CodegrrlPhpclique
through 1.0
CodegrrlPhpcurrently
through 2.0
CodegrrlPhpfanbase
through 2.2
CodegrrlPhpquotes
through 1.0

Weakness classification

CWE-94

References