SOC status:Duty analyst on shift

UK Cyber Defence
VulnerabilityModified

CVE-2006-5302

Multiple PHP remote file inclusion vulnerabilities in Redaction System 1.0000 allow remote attackers to execute arbitrary PHP code via a URL in the (1) lang_prefix parameter to (a) conn.php, (b) sesscheck.php, (c) wap/conn.php, or (d) wap/sesscheck.php,…

HIGH 7.5EPSS 9.64%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (9.64%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

Multiple PHP remote file inclusion vulnerabilities in Redaction System 1.0000 allow remote attackers to execute arbitrary PHP code via a URL in the (1) lang_prefix parameter to (a) conn.php, (b) sesscheck.php, (c) wap/conn.php, or (d) wap/sesscheck.php, or the (2) lang parameter to (e) index.php.

CVSS 2.0
7.5 HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
EPSS
9.64% probability · 95th percentile
CISA KEV
Not listed
Weakness
CWE-94
Affected
redaction system/redaction system
Source
cve@mitre.org

References

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.