CVE-2006-3421

PHP remote file inclusion vulnerability in SmartSiteCMS 1.0 and earlier, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via the root parameter in (1) comment.php, (2) admin/comedit.php, (3) admin/test.php, (4) admin/index.php, and (5) admin/include/inc_adminfoot.php, a different set of vectors than CVE-2006-3162.

CVSS v2.0

5.1 MEDIUMAV:N/AC:H/Au:N/C:P/I:P/A:P

EPSS

4.23% chance of exploitation in the next 30 days, 90th percentile

Published

2006-07-07

Updated

2024-08-07

ExploitDB entries (2)

• https://www.exploit-db.com/exploits/1974
• https://www.exploit-db.com/exploits/1936

References

• CVE Record
• NVD entry

Related

• CVE-2006-3405
• CVE-2006-3422
• CVE-2006-3403
• CVE-2006-3427
• CVE-2006-3402
• CVE-2006-3431