CVE-2006-7052

Public exploit code

Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.

• dotWidget for articles 2.0 - '/admin/editconfig.php' Multiple Remote File Inclusions2006-06-03 · webapps · php · Verified
• dotWidget for articles 2.0 - '/admin/categories.php' Multiple Remote File Inclusions2006-06-03 · webapps · php · Verified
• dotWidget for articles 2.0 - '/admin/index.php' Multiple Remote File Inclusions2006-06-03 · webapps · php · Verified
• dotWidget for articles 2.0 - '/admin/articles.php' Multiple Remote File Inclusions2006-06-03 · webapps · php · Verified
• dotWidget for articles 2.0 - '/admin/authors.php' Multiple Remote File Inclusions2006-06-03 · webapps · php · Verified
• dotWidget for articles 2.0 - 'showarticle.php?file_path' Remote File Inclusion2006-06-03 · webapps · php · Verified
• dotWidget for articles 2.0 - 'showcatpicks.php?file_path' Remote File Inclusion2006-06-03 · webapps · php · Verified

Impact

Multiple PHP remote file inclusion vulnerabilities in DotWidget For Articles (dotwidgeta) 0.2 allow remote attackers to execute arbitrary code via a URL in the (1) file_path parameter to (a) index.php, (b) showcatpicks.php, and (c) showarticle.php; and the (2) admin_header_file and (3) admin_footer_file parameters to (d) admin/authors.php, (e) admin/index.php, (f) admin/categories.php, (g) admin/editconfig.php, and (h) admin/articles.php.

Affected products

References

• NVD record
• CVE.org record
• http://securityreason.com/securityalert/2308
• http://www.securityfocus.com/archive/1/437483
• http://www.securityfocus.com/bid/18479
• https://exchange.xforce.ibmcloud.com/vulnerabilities/27327
• http://securityreason.com/securityalert/2308
• http://www.securityfocus.com/archive/1/437483
• http://www.securityfocus.com/bid/18479
• https://exchange.xforce.ibmcloud.com/vulnerabilities/27327