CVE-2006-1200
Direct static code injection vulnerability in add_link.txt in daverave Link Bank allows remote attackers to execute arbitrary PHP code via the url_name parameter, which is not sanitized before being stored in links.txt, which is later used in an include…
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (1.90%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
Direct static code injection vulnerability in add_link.txt in daverave Link Bank allows remote attackers to execute arbitrary PHP code via the url_name parameter, which is not sanitized before being stored in links.txt, which is later used in an include statement.
- CVSS 2.0
- 7.5 HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
- EPSS
- 1.90% probability · 79th percentile
- CISA KEV
- Not listed
- Affected
- daverave/link bank
- Source
- cve@mitre.org
References
- http://secunia.com/advisories/19154Exploit, Vendor Advisory
- http://securityreason.com/securityalert/553
- http://www.osvdb.org/23750
- http://www.securityfocus.com/archive/1/426932/100/0/threaded
- http://www.securityfocus.com/bid/17004
- http://www.vupen.com/english/advisories/2006/0885
- http://secunia.com/advisories/19154Exploit, Vendor Advisory
- http://securityreason.com/securityalert/553
- http://www.osvdb.org/23750
- http://www.securityfocus.com/archive/1/426932/100/0/threaded
- http://www.securityfocus.com/bid/17004
- http://www.vupen.com/english/advisories/2006/0885
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.