{"id": "CVE-2006-1154", "bulletinFamily": "NVD", "title": "CVE-2006-1154", "description": "PHP remote file inclusion vulnerability in archive.php in Fantastic News 2.1.2 allows remote attackers to include arbitrary files via the CONFIG[script_path] variable. NOTE: 2.1.4 was also reported to be vulnerable.", "published": "2006-03-10T06:02:00", "modified": "2017-10-10T21:30:41", "cvss": {"score": 7.5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}, "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2006-1154", "reporter": "NVD", "references": ["http://www.securityfocus.com/bid/16985", "http://www.vupen.com/english/advisories/2006/3513", "http://sx02.coresec.de/advisories/152.txt", "http://www.vupen.com/english/advisories/2006/0826", "https://exchange.xforce.ibmcloud.com/vulnerabilities/31121", "https://www.exploit-db.com/exploits/3027", "https://exchange.xforce.ibmcloud.com/vulnerabilities/25064", "http://www.securityfocus.com/bid/21796"], "cvelist": ["CVE-2006-1154"], "type": "cve", "lastseen": "2017-10-11T11:06:33", "history": [{"bulletin": {"assessment": {"href": "", "name": "", "system": ""}, "bulletinFamily": "NVD", "cpe": ["cpe:/a:fscripts:fantastic_news:2.1.1", "cpe:/a:fscripts:fantastic_news:2.1.2", "cpe:/a:fscripts:fantastic_news:2.1.4"], "cvelist": ["CVE-2006-1154"], "cvss": {"score": 7.5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}, "description": "PHP remote file inclusion vulnerability in archive.php in Fantastic News 2.1.2 allows remote attackers to include arbitrary files via the CONFIG[script_path] variable. NOTE: 2.1.4 was also reported to be vulnerable.", "edition": 2, "enchantments": {}, "hash": "a31027bfb27f14022f68fe1f2c8ecc65caa4a5fead6d86bf3bc34227e5cf4f6a", "hashmap": [{"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "scanner"}, {"hash": "601892ece72be3be2f57266ca2354792", "key": "reporter"}, {"hash": "163d0758c4fbf30ef2a8bb49d2edcea3", "key": "cpe"}, {"hash": "6f62225b05ac3c8ecb507f20466b800f", "key": "title"}, {"hash": "6d3f4796275bb54c21a33b82f399cc6d", "key": "assessment"}, {"hash": "e5d275b3ebd62646b78320753699e02e", "key": "cvss"}, {"hash": "b645e0917865e907e170638fddfb28f8", "key": "references"}, {"hash": "9aaff77c8cf8b119875c94f801415611", "key": "published"}, {"hash": "3c46d47d47fbd10ef00f26568e49c608", "key": "cvelist"}, {"hash": "1716b5fcbb7121af74efdc153d0166c5", "key": "type"}, {"hash": "af5049394f1be33548603cf7163eaf5c", "key": "modified"}, {"hash": "601892ece72be3be2f57266ca2354792", "key": "bulletinFamily"}, {"hash": "7a9431b396c34da6afdefbac3faca307", "key": "href"}, {"hash": "97ef797209d9792a1da7d54d1da177d3", "key": "description"}], "history": [], "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2006-1154", "id": "CVE-2006-1154", "lastseen": "2017-07-20T10:49:09", "modified": "2017-07-19T21:30:21", "objectVersion": "1.3", "published": "2006-03-10T06:02:00", "references": ["http://www.securityfocus.com/bid/16985", "http://www.vupen.com/english/advisories/2006/3513", "http://sx02.coresec.de/advisories/152.txt", "http://www.vupen.com/english/advisories/2006/0826", "https://exchange.xforce.ibmcloud.com/vulnerabilities/31121", "https://exchange.xforce.ibmcloud.com/vulnerabilities/25064", "http://www.securityfocus.com/bid/21796", "http://www.milw0rm.com/exploits/3027"], "reporter": "NVD", "scanner": [], "title": "CVE-2006-1154", "type": "cve", "viewCount": 1}, "differentElements": ["references", "modified"], "edition": 2, "lastseen": "2017-07-20T10:49:09"}, {"bulletin": {"assessment": {"href": "", "name": "", "system": ""}, "bulletinFamily": "NVD", "cpe": ["cpe:/a:fscripts:fantastic_news:2.1.1", "cpe:/a:fscripts:fantastic_news:2.1.2", "cpe:/a:fscripts:fantastic_news:2.1.4"], "cvelist": ["CVE-2006-1154"], "cvss": {"score": 7.5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}, "description": "PHP remote file inclusion vulnerability in archive.php in Fantastic News 2.1.2 allows remote attackers to include arbitrary files via the CONFIG[script_path] variable. NOTE: 2.1.4 was also reported to be vulnerable.", "edition": 1, "enchantments": {}, "hash": "5d68ce1d666727b5b626c65b79d0cb2c0441da5a7317aa1f395cfb706caa7068", "hashmap": [{"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "scanner"}, {"hash": "601892ece72be3be2f57266ca2354792", "key": "reporter"}, {"hash": "163d0758c4fbf30ef2a8bb49d2edcea3", "key": "cpe"}, {"hash": "6f62225b05ac3c8ecb507f20466b800f", "key": "title"}, {"hash": "fe347e3dee23c9904f39c3b770a25ea3", "key": "modified"}, {"hash": "6d3f4796275bb54c21a33b82f399cc6d", "key": "assessment"}, {"hash": "e5d275b3ebd62646b78320753699e02e", "key": "cvss"}, {"hash": "9aaff77c8cf8b119875c94f801415611", "key": "published"}, {"hash": "3c46d47d47fbd10ef00f26568e49c608", "key": "cvelist"}, {"hash": "1716b5fcbb7121af74efdc153d0166c5", "key": "type"}, {"hash": "601892ece72be3be2f57266ca2354792", "key": "bulletinFamily"}, {"hash": "7a9431b396c34da6afdefbac3faca307", "key": "href"}, {"hash": "02ee2f822f46eeb472dc8eee1b9ab3ab", "key": "references"}, {"hash": "97ef797209d9792a1da7d54d1da177d3", "key": "description"}], "history": [], "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2006-1154", "id": "CVE-2006-1154", "lastseen": "2016-09-03T06:36:49", "modified": "2011-08-23T00:00:00", "objectVersion": "1.2", "published": "2006-03-10T06:02:00", "references": ["http://www.securityfocus.com/bid/16985", "http://xforce.iss.net/xforce/xfdb/31121", "http://www.vupen.com/english/advisories/2006/3513", "http://sx02.coresec.de/advisories/152.txt", "http://www.vupen.com/english/advisories/2006/0826", "http://www.securityfocus.com/bid/21796", "http://www.milw0rm.com/exploits/3027", "http://xforce.iss.net/xforce/xfdb/25064"], "reporter": "NVD", "scanner": [], "title": "CVE-2006-1154", "type": "cve", "viewCount": 1}, "differentElements": ["references", "modified"], "edition": 1, "lastseen": "2016-09-03T06:36:49"}], "edition": 3, "hashmap": [{"key": "assessment", "hash": "6d3f4796275bb54c21a33b82f399cc6d"}, {"key": "bulletinFamily", "hash": "601892ece72be3be2f57266ca2354792"}, {"key": "cpe", "hash": "163d0758c4fbf30ef2a8bb49d2edcea3"}, {"key": "cvelist", "hash": "3c46d47d47fbd10ef00f26568e49c608"}, {"key": "cvss", "hash": "e5d275b3ebd62646b78320753699e02e"}, {"key": "description", "hash": "97ef797209d9792a1da7d54d1da177d3"}, {"key": "href", "hash": "7a9431b396c34da6afdefbac3faca307"}, {"key": "modified", "hash": "fa95b161982ef467ea04b228a71da840"}, {"key": "published", "hash": "9aaff77c8cf8b119875c94f801415611"}, {"key": "references", "hash": "6ea35deeb80e5ff4c41a02563a880087"}, {"key": "reporter", "hash": "601892ece72be3be2f57266ca2354792"}, {"key": "scanner", "hash": "d41d8cd98f00b204e9800998ecf8427e"}, {"key": "title", "hash": "6f62225b05ac3c8ecb507f20466b800f"}, {"key": "type", "hash": "1716b5fcbb7121af74efdc153d0166c5"}], "hash": "a3aee14ad50d2a80273c1c2418581b63bcbfdf156c06eb7c97ec6632b0e8c627", "viewCount": 1, "enchantments": {"score": {"value": 5.0, "vector": "NONE", "modified": "2017-10-11T11:06:33"}, "vulnersScore": 5.0}, "objectVersion": "1.3", "cpe": ["cpe:/a:fscripts:fantastic_news:2.1.1", "cpe:/a:fscripts:fantastic_news:2.1.2", "cpe:/a:fscripts:fantastic_news:2.1.4"], "assessment": {"href": "", "name": "", "system": ""}, "scanner": []}

{"osvdb": [{"lastseen": "2017-04-28T13:20:24", "references": [], "edition": 1, "description": "## Vulnerability Description\nFantastic News version 2.1.4 is vulnerable to a remote file inclusion attack. If successful, an attacker could control the vulnerable server remotely compromising the confidentiality, availability, and integrity of the target servers data.\n## Technical Description\nThis vulnerability is only present when the register_globals PHP option is set to 'on'. This has not been the default setting for PHP installs since version 4.2.0 (22-Apr-2002).\n## Solution Description\nEnsure that the variables are declared before including them into PHP scripts. This can be accomplished with the declare function.\n## Short Description\nFantastic News version 2.1.4 is vulnerable to a remote file inclusion attack. If successful, an attacker could control the vulnerable server remotely compromising the confidentiality, availability, and integrity of the target servers data.\n## References:\nVendor URL: http://fscripts.com/\n[Secunia Advisory ID:21807](https://secuniaresearch.flexerasoftware.com/advisories/21807/)\nOther Advisory URL: http://sx02.coresec.de/advisories/152.txt\nFrSIRT Advisory: ADV-2006-0826\nFrSIRT Advisory: ADV-2006-3513\n[CVE-2006-1154](https://vulners.com/cve/CVE-2006-1154)\nBugtraq ID: 16985\n", "reporter": "Core Security Germany()", "published": "2006-09-08T03:49:05", "type": "osvdb", "title": "Fantastic News archive.php CONFIG[script_path] Variable Remote File Inclusion", "enchantments": {"score": {"vector": "NONE", "value": 5.0}}, "bulletinFamily": "software", "affectedSoftware": [{"name": "Fantastic News", "version": "2.1.4", "operator": "eq"}], "cvelist": ["CVE-2006-1154"], "modified": "2006-09-08T03:49:05", "href": "https://vulners.com/osvdb/OSVDB:28599", "id": "OSVDB:28599", "cvss": {"score": 7.5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}}]}