Vulnerability CVE-2006-4733
Published: 2006-09-13   Modified: 2012-02-12

Description:
PHP remote file inclusion vulnerability in sipssys/code/box.inc.php in Haakon Nilsen simple, integrated publishing system (SIPS) 0.3.1 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the config[sipssys] parameter. NOTE: the product's documentation recommends placing the affected file outside of the web root, so the scope of issue is limited to admins who do not, or cannot, follow this recommendation.

See advisories in our WLB2 database:
Topic
Author
Date
High
SIPS v 0.2.2 < = Remote File Include Vulnerability
the leo
18.09.2006

Type:

CWE-Other

CVSS2 => (AV:N/AC:L/Au:N/C:P/I:P/A:P)

CVSS Base Score
Impact Subscore
Exploitability Subscore
7.5/10
6.4/10
10/10
Exploit range
Attack complexity
Authentication
Remote
Low
No required
Confidentiality impact
Integrity impact
Availability impact
Partial
Partial
Partial
Affected software
SIPS -> SIPS 

 References:
http://securityreason.com/securityalert/1549
http://sips.cvs.sourceforge.net/sips/sips/sipssys/code/box.inc.php?revision=1.9&view=markup
http://www.attrition.org/pipermail/vim/2007-February/001268.html
http://www.securityfocus.com/archive/1/445770/100/0/threaded
http://www.securityfocus.com/bid/19945
https://www.exploit-db.com/exploits/3245
Copyright 2024, cxsecurity.com

 

Back to Top