CVE-2006-4837
published 2006-09-15CVE-2006-4837: Multiple PHP remote file inclusion vulnerabilities in DCP-Portal SE 6.0 allow remote attackers to execute arbitrary PHP code via a URL in the root parameter in…
PriorityP265high7.5CVSS 2.0
AVNACLAuNCPIPAP
ITWVulnCheck KEV
Exploited in the wild
EPSS
2.74%
84.3th percentile
Multiple PHP remote file inclusion vulnerabilities in DCP-Portal SE 6.0 allow remote attackers to execute arbitrary PHP code via a URL in the root parameter in (1) library/lib.php and (2) library/editor/editor.php. NOTE: the same primary issue can be used for full path disclosure with an invalid parameter that reveals the installation path in an error message.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| codeworx_technologies | dcp-portal | — | — |
CVSS provenance
nvdv2.07.5HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
vulncheck7.5HIGH
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-4xc9-9hg8-5ggw: Multiple PHP remote file inclusion vulnerabilities in DCP-Portal SE 6
ghsa_unreviewed·2022-05-01
CVE-2006-4837 [HIGH] GHSA-4xc9-9hg8-5ggw: Multiple PHP remote file inclusion vulnerabilities in DCP-Portal SE 6
Multiple PHP remote file inclusion vulnerabilities in DCP-Portal SE 6.0 allow remote attackers to execute arbitrary PHP code via a URL in the root parameter in (1) library/lib.php and (2) library/editor/editor.php. NOTE: the same primary issue can be used for full path disclosure with an invalid parameter that reveals the installation path in an error message.
VulnCheck
codeworx_technologies dcp-portal Improper Control of Generation of Code ('Code Injection')
vulncheck·2006·CVSS 7.5
CVE-2006-4837 [HIGH] codeworx_technologies dcp-portal Improper Control of Generation of Code ('Code Injection')
codeworx_technologies dcp-portal Improper Control of Generation of Code ('Code Injection')
Multiple PHP remote file inclusion vulnerabilities in DCP-Portal SE 6.0 allow remote attackers to execute arbitrary PHP code via a URL in the root parameter in (1) library/lib.php and (2) library/editor/editor.php. NOTE: the same primary issue can be used for full path disclosure with an invalid parameter that reveals the installation path in an error message.
Affected: codeworx_technologies dcp-portal
Required Action: Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.
Exploitation References: https://www.vulncheck.com/advisories/dcp-portal-php-remote-inclusion-rce
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
http://securityreason.com/securityalert/1585http://www.securityfocus.com/archive/1/437510/100/200/threadedhttp://www.securityfocus.com/archive/1/445996/100/0/threadedhttp://www.securityfocus.com/bid/20024https://www.exploit-db.com/exploits/1905http://securityreason.com/securityalert/1585http://www.securityfocus.com/archive/1/437510/100/200/threadedhttp://www.securityfocus.com/archive/1/445996/100/0/threadedhttp://www.securityfocus.com/bid/20024https://www.exploit-db.com/exploits/1905
2006-09-15
Published
Exploited in the wild