CVE-2006-5473

** DISPUTED ** PHP remote file inclusion vulnerability in Description.php in Softerra PHP Developer Library 1.5.3 and earlier allows remote attackers to execute arbitrary PHP code via the lib_dir parameter. NOTE: this issue is disputed by CVE as of 20061023, since there is no Description.php file included in the product, and the existing "Description" file contains documentation, not functioning code.

CVSS v2.0 7.5 HIGH

7.5^/10

CVSS v2.0 : HIGH

Vector : AV:N/AC:L/Au:N/C:P/I:P/A:P

Exploitability : 10.0 / Impact : 6.4

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
http://attrition.org/pipermail/vim/2006-October/001090.html
http://securityreason.com/securityalert/1763
http://www.attrition.org/pipermail/vim/2006-October/001094.html
http://www.securityfocus.com/archive/1/449355/100/0/threaded

Configurations

Configuration 1 (hide)

cpe:2.3:a:softerra:php_developer_library:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2006-10-24 20:07

Updated : 2024-08-07 20:15

NVD link : CVE-2006-5473

Mitre link : CVE-2006-5473

CVE.ORG link : CVE-2006-5473

JSON object : View

Products Affected

softerra

php_developer_library

CWE

NVD-CWE-Other

{"id": "CVE-2006-5473", "cveTags": [{"tags": ["disputed"], "sourceIdentifier": "cve@mitre.org"}], "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 7.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": true, "userInteractionRequired": false}]}, "published": "2006-10-24T20:07:00.000", "references": [{"url": "http://attrition.org/pipermail/vim/2006-October/001090.html", "source": "cve@mitre.org"}, {"url": "http://securityreason.com/securityalert/1763", "source": "cve@mitre.org"}, {"url": "http://www.attrition.org/pipermail/vim/2006-October/001094.html", "source": "cve@mitre.org"}, {"url": "http://www.securityfocus.com/archive/1/449355/100/0/threaded", "source": "cve@mitre.org"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-Other"}]}], "descriptions": [{"lang": "en", "value": "PHP remote file inclusion vulnerability in Description.php in Softerra PHP Developer Library 1.5.3 and earlier allows remote attackers to execute arbitrary PHP code via the lib_dir parameter. NOTE: this issue is disputed by CVE as of 20061023, since there is no Description.php file included in the product, and the existing \"Description\" file contains documentation, not functioning code"}, {"lang": "es", "value": "** IMPUGNADA ** Vulnerabilidad de inclusi\u00f3n remota de archivo en PHP en Description.php en Softerra PHP Developer Library 1.5.3 y anteriores permite a atacantes remotos ejecutar c\u00f3digo PHP de su elecci\u00f3n mediante el par\u00e1metro lib_dir. NOTA: este asunto est\u00e1 impugnado por CVE el 23/10/2006, ya que no hay fichero Description.php incluido en el producto, y el fichero \"Description\" existente contiene documentaci\u00f3n, no c\u00f3digo."}], "lastModified": "2024-08-07T20:15:41.320", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:softerra:php_developer_library:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "862BD9E5-67B7-4326-BEDB-C2439C89E2C4", "versionEndIncluding": "1.5.3"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}