Published: 20/10/2006 Updated: 19/10/2017

CVSS v2 Base Score: 7.5 | Impact Score: 6.4 | Exploitability Score: 10

VMScore: 755

Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P

WSN Forum 1.3.4 and previous versions allows remote malicious users to execute arbitrary PHP code via a modified pathname in the pathtoconfig parameter that points to an avatar image that contains PHP code, which is then accessed from prestart.php. NOTE: this issue has been labeled remote file inclusion, but that label only applies to the attack, not the underlying vulnerability.

Vulnerable Product	Search on Vulmon	Subscribe to Product
wsn forum wsn forum

#!/usr/bin/php -q -d short_open_tag=on <? print ' ::::::::: :::::::::: ::: ::: ::::::::::: ::: :+: :+: :+: :+: :+: :+: :+: +:+ +:+ +:+ +:+ +:+ +:+ +:+ +#+ +:+ +#++:++# +#+ +:+ +#+ +#+ +#+ +#+ +#+ +#+ +#+ +#+ +#+ #+# ...

NVD-CWE-Other http://secunia.com/advisories/22360 http://www.securityfocus.com/bid/20586 http://www.vupen.com/english/advisories/2006/4081 https://exchange.xforce.ibmcloud.com/vulnerabilities/29635 https://www.exploit-db.com/exploits/2583 https://nvd.nist.gov https://www.exploit-db.com/exploits/2583/

Get Started

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Twitter Reddit Linkedin Facebook

CVE-2006-5421

Vulnerability Summary

Exploits

References

Vulmon Search

About

Products

Connect