Published: 31/05/2006 Updated: 19/10/2017

CVSS v2 Base Score: 4 | Impact Score: 4.9 | Exploitability Score: 4.9

VMScore: 415

Vector: AV:N/AC:H/Au:N/C:P/I:P/A:N

PHP remote file inclusion vulnerability in Basic Analysis and Security Engine (BASE) 1.2.4 and previous versions, with register_globals enabled, allows remote malicious users to execute arbitrary PHP code via a URL in the BASE_path parameter to (1) base_qry_common.php, (2) base_stat_common.php, and (3) includes/base_include.inc.php.

Vulnerable Product	Search on Vulmon	Subscribe to Product
kevin johnson basic analysis and security engine 1.2.2
kevin johnson basic analysis and security engine 1.2.4
kevin johnson basic analysis and security engine 1.2.0
kevin johnson basic analysis and security engine 1.2.1

## # $Id: base_qry_commonrb 11127 2010-11-24 19:35:38Z jduck $ ## ## # This file is part of the Metasploit Framework and may be subject to # redistribution and commercial restrictions Please see the Metasploit # Framework web site for more information on licensing and terms of use # metasploitcom/framework/ ## require 'msf/core' class ...

## # This file is part of the Metasploit Framework and may be subject to # redistribution and commercial restrictions Please see the Metasploit # Framework web site for more information on licensing and terms of use # metasploitcom/projects/Framework/ ## require 'msf/core' class Metasploit3 < Msf::Exploit::Remote include Msf::Expl ...

# Basic Analysis and Security Engine (BASE) <= 124 (melissa) Inclusion Vulnerabilities # Just glanced over BASE for a pentesting job /str0ke ! milw0rmcom ################################## [code (base_qry_commonphp)] include_once("$BASE_path/includes/base_signatureincphp"); [/code] [site]/snort/base_qry_commonphp?BASE_path= ...

CWE-94 http://secunia.com/advisories/20300 http://www.osvdb.org/25770 http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=370576 http://sourceforge.net/forum/forum.php?forum_id=577228 http://www.securityfocus.com/bid/18298 http://www.vupen.com/english/advisories/2006/1996 https://exchange.xforce.ibmcloud.com/vulnerabilities/26652 https://www.exploit-db.com/exploits/1823 https://nvd.nist.gov https://www.exploit-db.com/exploits/16897/

CVE-2006-2685

Vulnerability Summary

Exploits

References

Vulmon Search

About

Products

Connect