GSD-2006-3850

Vulnerability from gsd - Updated: 2023-12-13 01:19
Details
** DISPUTED ** PHP remote file inclusion vulnerability in upgrader.php in Vanilla CMS 1.0.1 and earlier, when /conf/old_settings.php exists, allows remote attackers to execute arbitrary PHP code via a URL in the RootDirectory parameter. NOTE: this issue has been disputed by a third party who states that the RootDirectory parameter is initialized before being used, for version 1.0. CVE analysis concurs with the dispute, but it is unclear whether older versions are affected.
Aliases
Aliases
CVE-2006-3850
To clipboard 

{
  "GSD": {
    "alias": "CVE-2006-3850",
    "description": "** DISPUTED **  PHP remote file inclusion vulnerability in upgrader.php in Vanilla CMS 1.0.1 and earlier, when /conf/old_settings.php exists, allows remote attackers to execute arbitrary PHP code via a URL in the RootDirectory parameter.  NOTE: this issue has been disputed by a third party who states that the RootDirectory parameter is initialized before being used, for version 1.0.  CVE analysis concurs with the dispute, but it is unclear whether older versions are affected.",
    "id": "GSD-2006-3850"
  },
  "gsd": {
    "metadata": {
      "exploitCode": "unknown",
      "remediation": "unknown",
      "reportConfidence": "confirmed",
      "type": "vulnerability"
    },
    "osvSchema": {
      "aliases": [
        "CVE-2006-3850"
      ],
      "details": "** DISPUTED **  PHP remote file inclusion vulnerability in upgrader.php in Vanilla CMS 1.0.1 and earlier, when /conf/old_settings.php exists, allows remote attackers to execute arbitrary PHP code via a URL in the RootDirectory parameter.  NOTE: this issue has been disputed by a third party who states that the RootDirectory parameter is initialized before being used, for version 1.0.  CVE analysis concurs with the dispute, but it is unclear whether older versions are affected.",
      "id": "GSD-2006-3850",
      "modified": "2023-12-13T01:19:57.702512Z",
      "schema_version": "1.4.0"
    }
  },
  "namespaces": {
    "cve.org": {
      "CVE_data_meta": {
        "ASSIGNER": "cve@mitre.org",
        "ID": "CVE-2006-3850",
        "STATE": "PUBLIC"
      },
      "affects": {
        "vendor": {
          "vendor_data": [
            {
              "product": {
                "product_data": [
                  {
                    "product_name": "n/a",
                    "version": {
                      "version_data": [
                        {
                          "version_value": "n/a"
                        }
                      ]
                    }
                  }
                ]
              },
              "vendor_name": "n/a"
            }
          ]
        }
      },
      "data_format": "MITRE",
      "data_type": "CVE",
      "data_version": "4.0",
      "description": {
        "description_data": [
          {
            "lang": "eng",
            "value": "** DISPUTED **  PHP remote file inclusion vulnerability in upgrader.php in Vanilla CMS 1.0.1 and earlier, when /conf/old_settings.php exists, allows remote attackers to execute arbitrary PHP code via a URL in the RootDirectory parameter.  NOTE: this issue has been disputed by a third party who states that the RootDirectory parameter is initialized before being used, for version 1.0.  CVE analysis concurs with the dispute, but it is unclear whether older versions are affected."
          }
        ]
      },
      "problemtype": {
        "problemtype_data": [
          {
            "description": [
              {
                "lang": "eng",
                "value": "n/a"
              }
            ]
          }
        ]
      },
      "references": {
        "reference_data": [
          {
            "name": "20060723 Vanilla CMS \u003c= 1.0.1 (RootDirectory) Remote file inclusion Vuln.",
            "refsource": "BUGTRAQ",
            "url": "http://www.securityfocus.com/archive/1/440938/100/0/threaded"
          },
          {
            "name": "20060724 Vanilla CMS",
            "refsource": "VIM",
            "url": "http://www.attrition.org/pipermail/vim/2006-July/000937.html"
          },
          {
            "name": "20060725 Vanilla CMS",
            "refsource": "VIM",
            "url": "http://www.attrition.org/pipermail/vim/2006-July/000944.html"
          },
          {
            "name": "20060805 Re: Vanilla CMS \u003c= 1.0.1 (RootDirectory) Remote file inclusion Vuln.",
            "refsource": "BUGTRAQ",
            "url": "http://www.securityfocus.com/archive/1/442450/100/0/threaded"
          },
          {
            "name": "1016568",
            "refsource": "SECTRACK",
            "url": "http://securitytracker.com/id?1016568"
          },
          {
            "name": "19127",
            "refsource": "BID",
            "url": "http://www.securityfocus.com/bid/19127"
          },
          {
            "name": "28287",
            "refsource": "OSVDB",
            "url": "http://www.osvdb.org/28287"
          },
          {
            "name": "1281",
            "refsource": "SREASON",
            "url": "http://securityreason.com/securityalert/1281"
          }
        ]
      }
    },
    "nvd.nist.gov": {
      "cve": {
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:a:lussumo:vanilla:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "AC4B0CBC-CFD0-406C-839B-59989734A693",
                    "versionEndIncluding": "1.0.1",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "descriptions": [
          {
            "lang": "en",
            "value": "PHP remote file inclusion vulnerability in upgrader.php in Vanilla CMS 1.0.1 and earlier, when /conf/old_settings.php exists, allows remote attackers to execute arbitrary PHP code via a URL in the RootDirectory parameter.  NOTE: this issue has been disputed by a third party who states that the RootDirectory parameter is initialized before being used, for version 1.0.  CVE analysis concurs with the dispute, but it is unclear whether older versions are affected"
          },
          {
            "lang": "es",
            "value": "** IMPUGNADA ** Vulnerabilidad de inclusi\u00f3n remota de archivo en PHP en upgrader.php de Vanilla CMS 1.0.1 y anteriores, cuando existe /conf/old_settings.php, permite a atacantes remotos ejecutar c\u00f3digo PHP de su elecci\u00f3n mediante un URL en el par\u00e1metro RootDirectory. NOTA: esta vulnerabilidad ha sido impugnada por una tercera parte que afirma que el par\u00e1metro RootDirectory se inicializa antes de ser utilizado, para la versi\u00f3n 1.0. El an\u00e1lisis de CVE coincide con la impugnaci\u00f3n, pero no est\u00e1 claro si las versiones anteriores est\u00e1n afectadas."
          }
        ],
        "id": "CVE-2006-3850",
        "lastModified": "2024-04-11T00:40:42.950",
        "metrics": {
          "cvssMetricV2": [
            {
              "acInsufInfo": false,
              "baseSeverity": "MEDIUM",
              "cvssData": {
                "accessComplexity": "HIGH",
                "accessVector": "NETWORK",
                "authentication": "NONE",
                "availabilityImpact": "PARTIAL",
                "baseScore": 5.1,
                "confidentialityImpact": "PARTIAL",
                "integrityImpact": "PARTIAL",
                "vectorString": "AV:N/AC:H/Au:N/C:P/I:P/A:P",
                "version": "2.0"
              },
              "exploitabilityScore": 4.9,
              "impactScore": 6.4,
              "obtainAllPrivilege": false,
              "obtainOtherPrivilege": true,
              "obtainUserPrivilege": false,
              "source": "nvd@nist.gov",
              "type": "Primary",
              "userInteractionRequired": false
            }
          ]
        },
        "published": "2006-07-25T23:04:00.000",
        "references": [
          {
            "source": "cve@mitre.org",
            "url": "http://securityreason.com/securityalert/1281"
          },
          {
            "source": "cve@mitre.org",
            "url": "http://securitytracker.com/id?1016568"
          },
          {
            "source": "cve@mitre.org",
            "url": "http://www.attrition.org/pipermail/vim/2006-July/000937.html"
          },
          {
            "source": "cve@mitre.org",
            "url": "http://www.attrition.org/pipermail/vim/2006-July/000944.html"
          },
          {
            "source": "cve@mitre.org",
            "url": "http://www.osvdb.org/28287"
          },
          {
            "source": "cve@mitre.org",
            "url": "http://www.securityfocus.com/archive/1/440938/100/0/threaded"
          },
          {
            "source": "cve@mitre.org",
            "url": "http://www.securityfocus.com/archive/1/442450/100/0/threaded"
          },
          {
            "source": "cve@mitre.org",
            "tags": [
              "Exploit"
            ],
            "url": "http://www.securityfocus.com/bid/19127"
          }
        ],
        "sourceIdentifier": "cve@mitre.org",
        "vulnStatus": "Modified",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "NVD-CWE-Other"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      }
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.