CVE-2006-5095
PHP remote file inclusion vulnerability in index.php in MyPhotos 0.1.3b beta allows remote attackers to execute arbitrary PHP code via the includesdir parameter.
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (1.48%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
PHP remote file inclusion vulnerability in index.php in MyPhotos 0.1.3b beta allows remote attackers to execute arbitrary PHP code via the includesdir parameter. NOTE: this issue is disputed by CVE on 20060927, since the includesdir is defined before being used when the product is installed according to the provided instructions
- CVSS 2.0
- 7.5 HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
- EPSS
- 1.48% probability · 72th percentile
- CISA KEV
- Not listed
- Affected
- myphotos/myphotos
- Source
- cve@mitre.org
References
- http://attrition.org/pipermail/vim/2006-September/001057.html
- http://securityreason.com/securityalert/1656
- http://www.securityfocus.com/archive/1/446876/100/0/threaded
- http://www.securityfocus.com/bid/20160
- http://attrition.org/pipermail/vim/2006-September/001057.html
- http://securityreason.com/securityalert/1656
- http://www.securityfocus.com/archive/1/446876/100/0/threaded
- http://www.securityfocus.com/bid/20160
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.