CVE-2006-4557

PHP remote file inclusion vulnerability in plugins/plugins.php in Bob Jewell Discloser 0.0.4 allows remote attackers to execute arbitrary PHP code via a URL in the type parameter. NOTE: another researcher has stated that an attacker cannot control the type parameter. As of 20060901, CVE analysis concurs with the dispute

CVSS v2.0

7.5 HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P

EPSS

1.48% chance of exploitation in the next 30 days, 72th percentile

Published

2006-09-06

Updated

2024-08-07

Proof-of-concept exploits (4)

• http://www.securityfocus.com/archive/1/443522/100/200/threaded
• http://www.securityfocus.com/archive/1/443466/100/200/threaded
• http://www.securityfocus.com/archive/1/443710/100/100/threaded
• http://www.securityfocus.com/archive/1/444074/100/100/threaded

References

• CVE Record
• NVD entry

Related

• CVE-2006-4553
• CVE-2006-4558
• CVE-2006-4545
• CVE-2006-4559
• CVE-2006-4543
• CVE-2006-4562