CVE-2006-7130

PHP remote file inclusion vulnerability in backend/primitives/cache/media.php in Jinzora 2.1 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the include_path parameter, a different vector than CVE-2006-6770.

CVSS v2.0 7.5 HIGH

7.5^/10

CVSS v2.0 : HIGH

V2 Legend

Vector : AV:N/AC:L/Au:N/C:P/I:P/A:P

Exploitability : 10.0 / Impact : 6.4

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
http://securityreason.com/securityalert/2351	Exploit
http://www.securityfocus.com/archive/1/448290/100/0/threaded
http://www.securityfocus.com/bid/20446	Exploit
https://exchange.xforce.ibmcloud.com/vulnerabilities/29436
https://www.exploit-db.com/exploits/2512
http://securityreason.com/securityalert/2351	Exploit
http://www.securityfocus.com/archive/1/448290/100/0/threaded
http://www.securityfocus.com/bid/20446	Exploit
https://exchange.xforce.ibmcloud.com/vulnerabilities/29436
https://www.exploit-db.com/exploits/2512

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:jinzora:jinzora::::::::
	cpe:2.3:a:jinzora:jinzora:0.1.1:::::::*
	cpe:2.3:a:jinzora:jinzora:0.2:::::::*
	cpe:2.3:a:jinzora:jinzora:0.3:::::::*
	cpe:2.3:a:jinzora:jinzora:0.3:pre::::::
	cpe:2.3:a:jinzora:jinzora:0.3:pre_2::::::
	cpe:2.3:a:jinzora:jinzora:0.3.1:::::::*
	cpe:2.3:a:jinzora:jinzora:0.4:::::::*
	cpe:2.3:a:jinzora:jinzora:0.5:::::::*
	cpe:2.3:a:jinzora:jinzora:0.6.2:::::::*
	cpe:2.3:a:jinzora:jinzora:0.7:::::::*
	cpe:2.3:a:jinzora:jinzora:0.8.1:::::::*
	cpe:2.3:a:jinzora:jinzora:0.8.2:::::::*
	cpe:2.3:a:jinzora:jinzora:0.9:::::::*
	cpe:2.3:a:jinzora:jinzora:0.9.1:::::::*
	cpe:2.3:a:jinzora:jinzora:0.9.2:::::::*
	cpe:2.3:a:jinzora:jinzora:0.9.3:::::::*
	cpe:2.3:a:jinzora:jinzora:0.9.4:::::::*
	cpe:2.3:a:jinzora:jinzora:0.9.5:::::::*
	cpe:2.3:a:jinzora:jinzora:1.0.1:::::::*
	cpe:2.3:a:jinzora:jinzora:1.1:::::::*
	cpe:2.3:a:jinzora:jinzora:2.0:::::::*
	cpe:2.3:a:jinzora:jinzora:2.0:beta_1::::::
	cpe:2.3:a:jinzora:jinzora:2.0:beta_2::::::
	cpe:2.3:a:jinzora:jinzora:2.0:rc1::::::
	cpe:2.3:a:jinzora:jinzora:2.0:rc2::::::
	cpe:2.3:a:jinzora:jinzora:2.0.1:::::::*

History

21 Nov 2024, 00:24

Type	Values Removed	Values Added
References	~~() http://securityreason.com/securityalert/2351 - Exploit~~	() http://securityreason.com/securityalert/2351 - Exploit
References	~~() http://www.securityfocus.com/archive/1/448290/100/0/threaded -~~	() http://www.securityfocus.com/archive/1/448290/100/0/threaded -
References	~~() http://www.securityfocus.com/bid/20446 - Exploit~~	() http://www.securityfocus.com/bid/20446 - Exploit
References	~~() https://exchange.xforce.ibmcloud.com/vulnerabilities/29436 -~~	() https://exchange.xforce.ibmcloud.com/vulnerabilities/29436 -
References	~~() https://www.exploit-db.com/exploits/2512 -~~	() https://www.exploit-db.com/exploits/2512 -

Information

Published : 2007-03-06 01:19

Updated : 2024-11-21 00:24

NVD link : CVE-2006-7130

Mitre link : CVE-2006-7130

CVE.ORG link : CVE-2006-7130

JSON object : View

Products Affected

jinzora

jinzora

CWE

CWE-94

Improper Control of Generation of Code ('Code Injection')

7.5 /10