CVE-2006-0881

Multiple PHP remote file include vulnerabilities in gorum/gorumlib.php in Noah's Classifieds 1.3, when register_globals is enabled, allow remote attackers to include arbitrary PHP files via the (1) upperTemplate and (2) lowerTemplate parameters, as demonstrated using the lowerTemplate parameter to index.php.

Score

CVSS 2.0 7.5 High

Status

Modified - cve@mitre.org

Published

2006-02-24

Last modified

2024-08-07

Affected products

• Noahs Classifieds (Phpoutsourcing)

References

• http://securitytracker.com/id?1015667
• http://www.kapda.ir/advisory-268.html
• http://www.securityfocus.com/archive/1/425783/100/0/threaded
• http://www.securityfocus.com/bid/16780
• http://www.vupen.com/english/advisories/2006/0703
• https://exchange.xforce.ibmcloud.com/vulnerabilities/24899