CVE-2005-1996 PHP remote file inclusion vulnerability in start.php in Bitrix Site Manager 4.0.x allows remote attackers to execute arbitrary PHP code via the _SERVER[DOCUMENT_ROOT] parameter.
MediumCVSS 5.0
EPSS 1.5%
- Published
- Updated
- Exploit status
- No public exploit known
Description
PHP remote file inclusion vulnerability in start.php in Bitrix Site Manager 4.0.x allows remote attackers to execute arbitrary PHP code via the _SERVER[DOCUMENT_ROOT] parameter.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| bitrix site manager | = 4.0.0 | No fix listed |
| bitrix site manager | = 4.0.2 | No fix listed |
| bitrix site manager | = 4.0.3 | No fix listed |
| bitrix site manager | = 4.0.4 | No fix listed |
| bitrix site manager | = 4.0.5 | No fix listed |
| bitrix site manager | = 4.0.6 | No fix listed |
| bitrix site manager | = 4.0.7 | No fix listed |
| bitrix site manager | = 4.0.8 | No fix listed |
References
- 20050615 Vulnerability: Bitrix Php inclusion mailing-list
- 15726 patch third-party-advisory vendor-advisory
- www.bitrixsoft.com patch
- www.bitrixsoft.com patch
- 17341 patch vdb-entry
- 13965 vdb-entry
- ADV-2005-0779 vdb-entry vendor-advisory
- bitrix-serverdocumentroot-file-include(21018) vdb-entry