VulnerabilityModified
CVE-2006-5085
Static code injection vulnerability in config.php in Blog Pixel Motion 2.1.1 allows remote attackers to execute arbitrary PHP code via the nom_blog parameter, which is injected into include/variables.php.
HIGH 7.5EPSS 46.6%
Does this matter?
EPSS puts the probability of exploitation in the next 30 days at 46.6%, higher than 99% of all known CVEs. Patch or mitigate before the next change window.
Description
Static code injection vulnerability in config.php in Blog Pixel Motion 2.1.1 allows remote attackers to execute arbitrary PHP code via the nom_blog parameter, which is injected into include/variables.php.
- CVSS 2.0
- 7.5 HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
- EPSS
- 46.65% probability · 99th percentile
- CISA KEV
- Not listed
- Affected
- pixel motion/pixel motion blog
- Source
- cve@mitre.org
References
- http://acid-root.new.fr/poc/12060927.txtExploit
- http://secunia.com/advisories/22163Vendor Advisory
- http://securityreason.com/securityalert/1653
- http://www.securityfocus.com/archive/1/447167/100/0/threaded
- http://www.securityfocus.com/bid/20235Exploit
- https://exchange.xforce.ibmcloud.com/vulnerabilities/29217
- http://acid-root.new.fr/poc/12060927.txtExploit
- http://secunia.com/advisories/22163Vendor Advisory
- http://securityreason.com/securityalert/1653
- http://www.securityfocus.com/archive/1/447167/100/0/threaded
- http://www.securityfocus.com/bid/20235Exploit
- https://exchange.xforce.ibmcloud.com/vulnerabilities/29217
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.