CVE-2006-7091 PHP remote file inclusion vulnerability in config.php in phpht Topsites FREE 1.022b allows remote attackers to execute arbitrary PHP code via a URL in the fullpath parameter. NOTE: the provenance of t...

HighCVSS 7.5 EPSS 2.1% Public exploit

Published: 2007-02-28 14:52 (approximate time: when CVE Radar first recorded it)
Updated: 2026-06-17 01:34
Exploit status: Public exploit available

Description

PHP remote file inclusion vulnerability in config.php in phpht Topsites FREE 1.022b allows remote attackers to execute arbitrary PHP code via a URL in the fullpath parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.

Affected products

Product	Affected versions	Fixed in
hinton design phpht topsites free	= 1.022b	No fix listed

References

20486 exploit patch vdb-entry vendor-advisory

CVSS v2.0

7.5 High

AV:N/AC:L/Au:N/C:P/I:P/A:P

Access Vector: Network
Access Complexity: Low
Authentication: None
Confidentiality: Partial
Integrity: Partial
Availability: Partial

Weakness & likelihood

EPSS (exploitation probability, 30 days): 2.15% (percentile 82.4)
CWE: Not classified

Public exploit references

Metadata only. CVERadar never hosts or runs exploit code.

PHP TopSites FREE 1.022b - 'config.php' Remote File Inclusion Exploit · Exploit Database (OffSec) · 2006-10-12