CVE-2006-5838 - PHP remote file inclusion vulnerability in lib/class.Database.php in NewP News Publication System 1.

CVE-2006-5838

Summary

PHP remote file inclusion vulnerability in lib/class.Database.php in NewP News Publication System 1.0.0, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via the path parameter.

References

http://securityreason.com/securityalert/1835
http://www.securityfocus.com/archive/1/450823/100/0/threaded
http://www.securityfocus.com/bid/20893
https://exchange.xforce.ibmcloud.com/vulnerabilities/30086

Vulnerable Configurations

cpe:2.3:a:newp:news_publication_system:1.0.0:*:*:*:*:*:*:*
cpe:2.3:a:newp:news_publication_system:1.0.0:*:*:*:*:*:*:*

CVSS

Base:	5.1 (as of 17-10-2018 - 21:45)
Impact:
Exploitability:

CWE

NVD-CWE-Other

CAPEC

Access

Vector	Complexity	Authentication
NETWORK	HIGH	NONE

Impact

Confidentiality	Integrity	Availability
PARTIAL	PARTIAL	PARTIAL

cvss-vector via4

AV:N/AC:H/Au:N/C:P/I:P/A:P

refmap via4

bid	20893
bugtraq	20061107 News publication system remote File include
sreason	1835
xf	newp-database-file-include(30086)

Last major update

17-10-2018 - 21:45

Published

10-11-2006 - 01:07

Last modified

17-10-2018 - 21:45