CVE-2006-3053

PHP remote file inclusion vulnerability in common.php in PHORUM 5.1.13 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the PHORUM[http_path] parameter. NOTE: this issue has been disputed by the vendor, who states "common.php is checked on the very first line of non-comment code that it is not being called directly. It has been this way in all 5.x version of Phorum." CVE analysis concurs with the vendor

CVSS v2.0

7.5 HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P

EPSS

2.89% chance of exploitation in the next 30 days, 86th percentile

Published

2006-06-16

Updated

2024-08-07

ExploitDB entries (1)

• https://www.exploit-db.com/exploits/27363

References

• CVE Record
• NVD entry

Related

• CVE-2006-3052
• CVE-2006-3059
• CVE-2006-3051
• CVE-2006-3061
• CVE-2006-3050
• CVE-2006-3065