Vulnerability-Lookup

GHSA-X3WJ-M6PH-VG8J

Vulnerability from github – Published: 2022-05-01 07:21 – Updated: 2022-05-01 07:21

Details

PHP remote file inclusion vulnerability in sipssys/code/box.inc.php in Haakon Nilsen simple, integrated publishing system (SIPS) 0.3.1 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the config[sipssys] parameter. NOTE: the product's documentation recommends placing the affected file outside of the web root, so the scope of issue is limited to admins who do not, or cannot, follow this recommendation.

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2006-4733"
  ],
  "database_specific": {
    "cwe_ids": [],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2006-09-13T22:07:00Z",
    "severity": "HIGH"
  },
  "details": "PHP remote file inclusion vulnerability in sipssys/code/box.inc.php in Haakon Nilsen simple, integrated publishing system (SIPS) 0.3.1 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the config[sipssys] parameter.  NOTE: the product\u0027s documentation recommends placing the affected file outside of the web root, so the scope of issue is limited to admins who do not, or cannot, follow this recommendation.",
  "id": "GHSA-x3wj-m6ph-vg8j",
  "modified": "2022-05-01T07:21:22Z",
  "published": "2022-05-01T07:21:22Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2006-4733"
    },
    {
      "type": "WEB",
      "url": "https://www.exploit-db.com/exploits/3245"
    },
    {
      "type": "WEB",
      "url": "http://securityreason.com/securityalert/1549"
    },
    {
      "type": "WEB",
      "url": "http://sips.cvs.sourceforge.net/sips/sips/sipssys/code/box.inc.php?revision=1.9\u0026view=markup"
    },
    {
      "type": "WEB",
      "url": "http://www.attrition.org/pipermail/vim/2007-February/001268.html"
    },
    {
      "type": "WEB",
      "url": "http://www.securityfocus.com/archive/1/445770/100/0/threaded"
    },
    {
      "type": "WEB",
      "url": "http://www.securityfocus.com/bid/19945"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

CVE-2006-4733 (GCVE-0-2006-4733)

Vulnerability from cvelistv5 – Published: 2006-09-13 22:00 – Updated: 2024-08-07 19:23

Summary

Severity ?

No CVSS data available.

CWE

Assigner

mitre

References

URL

Tags

	http://sips.cvs.sourceforge.net/sips/sips/sipssys…	x_refsource_MISC
	http://securityreason.com/securityalert/1549	third-party-advisoryx_refsource_SREASON
	http://www.attrition.org/pipermail/vim/2007-Febru…	mailing-listx_refsource_VIM
	https://www.exploit-db.com/exploits/3245	exploitx_refsource_EXPLOIT-DB
	http://www.securityfocus.com/archive/1/445770/100…	mailing-listx_refsource_BUGTRAQ
	http://www.securityfocus.com/bid/19945	vdb-entryx_refsource_BID

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-07T19:23:41.196Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://sips.cvs.sourceforge.net/sips/sips/sipssys/code/box.inc.php?revision=1.9\u0026view=markup"
          },
          {
            "name": "1549",
            "tags": [
              "third-party-advisory",
              "x_refsource_SREASON",
              "x_transferred"
            ],
            "url": "http://securityreason.com/securityalert/1549"
          },
          {
            "name": "20070201 true but: SIPS \u003c= 0.3.1(box.inc.php) Remote File Include Vulnerability",
            "tags": [
              "mailing-list",
              "x_refsource_VIM",
              "x_transferred"
            ],
            "url": "http://www.attrition.org/pipermail/vim/2007-February/001268.html"
          },
          {
            "name": "3245",
            "tags": [
              "exploit",
              "x_refsource_EXPLOIT-DB",
              "x_transferred"
            ],
            "url": "https://www.exploit-db.com/exploits/3245"
          },
          {
            "name": "20060910 SIPS v 0.2.2 \u003c = Remote File Include Vulnerability",
            "tags": [
              "mailing-list",
              "x_refsource_BUGTRAQ",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/archive/1/445770/100/0/threaded"
          },
          {
            "name": "19945",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/19945"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2006-09-10T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "PHP remote file inclusion vulnerability in sipssys/code/box.inc.php in Haakon Nilsen simple, integrated publishing system (SIPS) 0.3.1 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the config[sipssys] parameter.  NOTE: the product\u0027s documentation recommends placing the affected file outside of the web root, so the scope of issue is limited to admins who do not, or cannot, follow this recommendation."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2018-10-17T20:57:01",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://sips.cvs.sourceforge.net/sips/sips/sipssys/code/box.inc.php?revision=1.9\u0026view=markup"
        },
        {
          "name": "1549",
          "tags": [
            "third-party-advisory",
            "x_refsource_SREASON"
          ],
          "url": "http://securityreason.com/securityalert/1549"
        },
        {
          "name": "20070201 true but: SIPS \u003c= 0.3.1(box.inc.php) Remote File Include Vulnerability",
          "tags": [
            "mailing-list",
            "x_refsource_VIM"
          ],
          "url": "http://www.attrition.org/pipermail/vim/2007-February/001268.html"
        },
        {
          "name": "3245",
          "tags": [
            "exploit",
            "x_refsource_EXPLOIT-DB"
          ],
          "url": "https://www.exploit-db.com/exploits/3245"
        },
        {
          "name": "20060910 SIPS v 0.2.2 \u003c = Remote File Include Vulnerability",
          "tags": [
            "mailing-list",
            "x_refsource_BUGTRAQ"
          ],
          "url": "http://www.securityfocus.com/archive/1/445770/100/0/threaded"
        },
        {
          "name": "19945",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/19945"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2006-4733",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "PHP remote file inclusion vulnerability in sipssys/code/box.inc.php in Haakon Nilsen simple, integrated publishing system (SIPS) 0.3.1 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the config[sipssys] parameter.  NOTE: the product\u0027s documentation recommends placing the affected file outside of the web root, so the scope of issue is limited to admins who do not, or cannot, follow this recommendation."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "http://sips.cvs.sourceforge.net/sips/sips/sipssys/code/box.inc.php?revision=1.9\u0026view=markup",
              "refsource": "MISC",
              "url": "http://sips.cvs.sourceforge.net/sips/sips/sipssys/code/box.inc.php?revision=1.9\u0026view=markup"
            },
            {
              "name": "1549",
              "refsource": "SREASON",
              "url": "http://securityreason.com/securityalert/1549"
            },
            {
              "name": "20070201 true but: SIPS \u003c= 0.3.1(box.inc.php) Remote File Include Vulnerability",
              "refsource": "VIM",
              "url": "http://www.attrition.org/pipermail/vim/2007-February/001268.html"
            },
            {
              "name": "3245",
              "refsource": "EXPLOIT-DB",
              "url": "https://www.exploit-db.com/exploits/3245"
            },
            {
              "name": "20060910 SIPS v 0.2.2 \u003c = Remote File Include Vulnerability",
              "refsource": "BUGTRAQ",
              "url": "http://www.securityfocus.com/archive/1/445770/100/0/threaded"
            },
            {
              "name": "19945",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/19945"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2006-4733",
    "datePublished": "2006-09-13T22:00:00",
    "dateReserved": "2006-09-13T00:00:00",
    "dateUpdated": "2024-08-07T19:23:41.196Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

GHSA-X3WJ-M6PH-VG8J

CVE-2006-4733 (GCVE-0-2006-4733)

Tags

Sightings

Nomenclature