CVE-2006-3611

Directory traversal vulnerability in pm.php in Phorum 5 allows remote authenticated users to include and execute arbitrary local files via directory traversal sequences in the GLOBALS[template] parameter, as demonstrated by injecting PHP sequences into a log file, which is then included by pm.php.

CVSS v2.0

5.5 MEDIUMAV:N/AC:L/Au:S/C:P/I:P/A:N

EPSS

2.16% chance of exploitation in the next 30 days, 81th percentile

Published

2006-07-14

Updated

2024-08-07

ExploitDB entries (1)

• https://www.exploit-db.com/exploits/2008

References

• CVE Record
• NVD entry

Related

• CVE-2006-3608
• CVE-2006-3616
• CVE-2006-3607
• CVE-2006-3621
• CVE-2006-3605
• CVE-2006-3624