medium5.1Public exploit code
CVE-2006-4596
PHP remote file inclusion in MyBace Light Skrip, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via the (1) hauptverze…
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- MyBace Light - 'login_check.php' Remote File2006-09-01 · webapps · php · Verified
Impact
PHP remote file inclusion in MyBace Light Skrip, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via the (1) hauptverzeichniss parameter in includes/login_check.php and the (2) template_back parameter in admin/login/content/user_daten.php.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Mybace Light | Mybace Light | All versions |
References
- NVD record
- CVE.org record
- http://secunia.com/advisories/21746
- http://www.bb-pcsecurity.de/Websecurity/384/org/MyBace_Light_%28hauptverzeichniss%29_Remote_File_Inclusion.htm
- http://www.securityfocus.com/archive/1/445185/100/0/threaded
- http://www.securityfocus.com/bid/19811
- http://www.securityfocus.com/bid/19830
- http://www.vupen.com/english/advisories/2006/3447
- http://secunia.com/advisories/21746
- http://www.bb-pcsecurity.de/Websecurity/384/org/MyBace_Light_%28hauptverzeichniss%29_Remote_File_Inclusion.htm
- http://www.securityfocus.com/archive/1/445185/100/0/threaded
- http://www.securityfocus.com/bid/19811
- http://www.securityfocus.com/bid/19830
- http://www.vupen.com/english/advisories/2006/3447