medium5.1Public exploit code
CVE-2006-0786
Incomplete blacklist vulnerability in include.php in PHPKIT 1.6.1 Release 2 and earlier, with allow_url_fopen enabled, allows remote attackers to conduct PHP r…
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- PHPKIT 1.6.1R2 - 'filecheck' Remote Command Execution2006-02-16 · webapps · php · Verified
Impact
Incomplete blacklist vulnerability in include.php in PHPKIT 1.6.1 Release 2 and earlier, with allow_url_fopen enabled, allows remote attackers to conduct PHP remote file include attacks via a path parameter that specifies a (1) UNC share or (2) ftps URL, which bypasses the check for "http://", "ftp://", and "https://" URLs.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Phpkit | Phpkit | through 1.6.1 |
References
- NVD record
- CVE.org record
- http://retrogod.altervista.org/phpkit_161r2_incl_xpl.html
- http://securityreason.com/securityalert/445
- http://securitytracker.com/id?1015640
- http://www.securityfocus.com/archive/1/425196/100/0/threaded
- http://retrogod.altervista.org/phpkit_161r2_incl_xpl.html
- http://securityreason.com/securityalert/445
- http://securitytracker.com/id?1015640
- http://www.securityfocus.com/archive/1/425196/100/0/threaded