CVE-2006-4596 PHP remote file inclusion in MyBace Light Skrip, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via the (1) hauptverzeichniss parameter in includes/login_check...
MediumCVSS 5.1
EPSS 3.2%
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
PHP remote file inclusion in MyBace Light Skrip, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via the (1) hauptverzeichniss parameter in includes/login_check.php and the (2) template_back parameter in admin/login/content/user_daten.php.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| mybace light | All versions | No fix listed |
References
- 21746 third-party-advisory vendor-advisory
- www.bb-pcsecurity.de
- 20060901 MyBace Light (hauptverzeichniss) Remote File Inclusion mailing-list
- 19811 vdb-entry
- 19830 vdb-entry
- ADV-2006-3447 vdb-entry