CVE-2006-4837

Multiple PHP remote file inclusion vulnerabilities in DCP-Portal SE 6.0 allow remote attackers to execute arbitrary PHP code via a URL in the root parameter in (1) library/lib.php and (2) library/editor/editor.php. NOTE: the same primary issue can be used for full path disclosure with an invalid parameter that reveals the installation path in an error message.

CVSS v2.0

7.5 HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P

EPSS

2.81% chance of exploitation in the next 30 days, 86th percentile

Published

2006-09-15

Updated

2024-08-07

Proof-of-concept exploits (1)

• https://www.exploit-db.com/exploits/1905

References

• CVE Record
• NVD entry

Related

• CVE-2006-4836
• CVE-2006-4838
• CVE-2006-4834
• CVE-2006-4842
• CVE-2006-4832
• CVE-2006-4844