CVE-2006-1503 PHP remote file inclusion vulnerability in includes/functions_install.php in Virtual War (VWar) 1.5.0 R11 and earlier allows remote attackers to include and execute arbitrary PHP code via a URL in the...
MediumCVSS 5.1
EPSS 2.0%
- Published
- Updated
- Exploit status
- No public exploit known
Description
PHP remote file inclusion vulnerability in includes/functions_install.php in Virtual War (VWar) 1.5.0 R11 and earlier allows remote attackers to include and execute arbitrary PHP code via a URL in the vwar_root parameter. NOTE: this is a different vulnerability than CVE-2006-1636.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| vwar virtual war | = 1.0.0 | No fix listed |
| vwar virtual war | = 1.0.1 | No fix listed |
| vwar virtual war | = 1.0.2 | No fix listed |
| vwar virtual war | = 1.0.3 | No fix listed |
| vwar virtual war | = 1.0.4 | No fix listed |
| vwar virtual war | = 1.0.5 | No fix listed |
| vwar virtual war | = 1.0.6 | No fix listed |
| vwar virtual war | = 1.0.7 | No fix listed |
| vwar virtual war | = 1.0.8 | No fix listed |
| vwar virtual war | = 1.0.9 | No fix listed |
| vwar virtual war | = 1.1.0 | No fix listed |
| vwar virtual war | = 1.1.1 | No fix listed |
| vwar virtual war | = 1.1.2 | No fix listed |
| vwar virtual war | = 1.1.3 | No fix listed |
| vwar virtual war | = 1.1.4 | No fix listed |
| vwar virtual war | = 1.1.5 | No fix listed |
| vwar virtual war | = 1.1.6 | No fix listed |
| vwar virtual war | = 1.1.7 | No fix listed |
| vwar virtual war | = 1.1.8 | No fix listed |
| vwar virtual war | = 1.2.0 | No fix listed |
| vwar virtual war | = 1.2.1 | No fix listed |
| vwar virtual war | = 1.2.2 | No fix listed |
| vwar virtual war | = 1.3 | No fix listed |
| vwar virtual war | = 1.4 | No fix listed |
| vwar virtual war | = 1.5 | No fix listed |
Show 11 more
| Product | Affected versions | Fixed in |
|---|---|---|
| vwar virtual war | = 1.5.0_r1 | No fix listed |
| vwar virtual war | = 1.5.0_r2 | No fix listed |
| vwar virtual war | = 1.5.0_r3 | No fix listed |
| vwar virtual war | = 1.5.0_r4 | No fix listed |
| vwar virtual war | = 1.5.0_r5 | No fix listed |
| vwar virtual war | = 1.5.0_r6 | No fix listed |
| vwar virtual war | = 1.5.0_r7 | No fix listed |
| vwar virtual war | = 1.5.0_r8 | No fix listed |
| vwar virtual war | = 1.5.0_r9 | No fix listed |
| vwar virtual war | = 1.5.0_r10 | No fix listed |
| vwar virtual war | = 1.5.0_r11 | No fix listed |
References
- 20060403 Vendor ACK for VWar issue - VWar used by PhpNuke Clan mailing-list
- 19438 third-party-advisory vendor-advisory
- 24239 vdb-entry
- 20060328 VWar <= 1.5.0 R11 Remote Code Execution Exploit mailing-list
- 17290 exploit vdb-entry
- ADV-2006-1144 vdb-entry vendor-advisory
- virtual-war-functionsinstall-file-include(25497) vdb-entry