CVE-2006-3847
published 2006-07-25CVE-2006-3847: PHP remote file inclusion vulnerability in (1) admin.php, and possibly (2) details.php, (3) modify.php, (4) newgroup.php, (5) newtask.php, and (6) rss.php, in…
PriorityP335medium5.1CVSS 2.0
AVNACHAuNCPIPAP
EXPLOIT
EPSS
3.08%
86.1th percentile
PHP remote file inclusion vulnerability in (1) admin.php, and possibly (2) details.php, (3) modify.php, (4) newgroup.php, (5) newtask.php, and (6) rss.php, in MoSpray (aka com_mospray) 1.8 RC1 allows remote attackers to execute arbitrary PHP code via a URL in the basedir parameter.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache | httpd | — | — |
| canebluem | mospray | — | — |
CVSS provenance
nvdv2.05.1MEDIUMAV:N/AC:H/Au:N/C:P/I:P/A:P
vendor_apache5.0
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-pfjh-mw5x-c628: PHP remote file inclusion vulnerability in (1) admin
ghsa_unreviewed·2022-05-01
CVE-2006-3847 [MEDIUM] CWE-94 GHSA-pfjh-mw5x-c628: PHP remote file inclusion vulnerability in (1) admin
PHP remote file inclusion vulnerability in (1) admin.php, and possibly (2) details.php, (3) modify.php, (4) newgroup.php, (5) newtask.php, and (6) rss.php, in MoSpray (aka com_mospray) 1.8 RC1 allows remote attackers to execute arbitrary PHP code via a URL in the basedir parameter.
Apache
Apache httpd: CVE-2007-3847
vendor_apache·CVSS 5.0
CVE-2007-3847 Apache httpd: CVE-2007-3847
Apache httpd: CVE-2007-3847
A flaw was found in the Apache HTTP Server mod_proxy module. On sites where a reverse proxy is configured, a remote attacker could send a carefully crafted request that would cause the Apache child process handling that request to crash. On sites where a forward proxy is configured, an attacker could cause a similar crash if a user could be persuaded to visit a malicious site using the proxy. This could lead to a denial of service if using a threaded Multi-Processing Module. Reported to security team 2006-12-10 Issue public 2006-12-10 Update 2.2.6 released 2007-09-07 Update 2.0.61 released 2007-09-07 Affects 2.2.4, 2.2.3, 2.2.2, 2.2.0, 2.0.59, 2.0.58, 2.0.55, 2.0.54, 2.0.53, 2.0.52, 2.0.51, 2.0.50, 2.0.49, 2.0.48, 2.0.47, 2.0.46, 2.0.45, 2.0.44, 2.0.43, 2.0.42,
No detection rules found.
No writeups or analysis indexed.
http://kurdishsecurity.blogspot.com/2006/07/kurdish-security-14-mospray-basedir.htmlhttp://secunia.com/advisories/21166http://www.securityfocus.com/archive/1/440939/100/200/threadedhttp://www.securityfocus.com/bid/19122http://www.vupen.com/english/advisories/2006/2932https://exchange.xforce.ibmcloud.com/vulnerabilities/27917https://www.exploit-db.com/exploits/2062http://kurdishsecurity.blogspot.com/2006/07/kurdish-security-14-mospray-basedir.htmlhttp://secunia.com/advisories/21166http://www.securityfocus.com/archive/1/440939/100/200/threadedhttp://www.securityfocus.com/bid/19122http://www.vupen.com/english/advisories/2006/2932https://exchange.xforce.ibmcloud.com/vulnerabilities/27917https://www.exploit-db.com/exploits/2062
2006-07-25
Published