high7.5Public exploit code
CVE-2006-0164
phgstats.inc.php in phgstats before 0.5.1, if register_globals is enabled, allows remote attackers to include arbitrary files and execute arbitrary PHP code by…
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- PostNuke Module phgstats 0.5 - 'phgdir' Remote File Inclusion2007-03-11 · webapps · php · Verified
Impact
phgstats.inc.php in phgstats before 0.5.1, if register_globals is enabled, allows remote attackers to include arbitrary files and execute arbitrary PHP code by modifying the PHGDIR variable.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Woah-Projekt | Phgstats | Versions 0.1, 0.2, 0.3, 0.3.1, 0.4, 0.4.1 |
References
- NVD record
- CVE.org record
- http://secunia.com/advisories/18346
- http://sourceforge.net/project/shownotes.php?release_id=384232
- http://www.osvdb.org/22302
- http://www.securityfocus.com/bid/17469
- http://www.vupen.com/english/advisories/2006/0123
- https://exchange.xforce.ibmcloud.com/vulnerabilities/24062
- http://secunia.com/advisories/18346
- http://sourceforge.net/project/shownotes.php?release_id=384232
- http://www.osvdb.org/22302
- http://www.securityfocus.com/bid/17469
- http://www.vupen.com/english/advisories/2006/0123
- https://exchange.xforce.ibmcloud.com/vulnerabilities/24062