CVE-2006-5392 - Vulnerability Details - OpenCVE

Multiple PHP remote file inclusion vulnerabilities in OpenDock FullCore 4.4 and earlier allow remote attackers to execute arbitrary PHP code via a URL in the doc_directory parameter in (1) sw/index_sw.php; (2) cart.php, (3) lib_cart.php, (4) lib_read_cart.php, (5) lib_sys_cart.php, and (6) txt_info_cart.php in sw/lib_cart/; (7) comment.php, (8) find_comment.php, and (9) lib_comment.php in sw/lib_comment/; (10) sw/lib_find/find.php; and other unspecified PHP scripts.

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

Access Vector Network

Access Complexity Low

Authentication None

Confidentiality Impact Partial

Integrity Impact Partial

Availability Impact Partial

This CVE is not in the KEV list.

The EPSS score is 0.14931.

Key SSVC decision points have not yet been added.

Vendors	Products
Opendoc Subscribe	Fullcore Subscribe

Configuration 1 [-]

cpe:2.3:a:opendoc:fullcore:*:*:*:*:*:*:*:*

No data.

No data.

Advisories

No advisories yet.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References

Link	Providers
http://secunia.com/advisories/22410
http://www.osvdb.org/29906
http://www.osvdb.org/29907
http://www.osvdb.org/29908
http://www.osvdb.org/29909
http://www.osvdb.org/29910
http://www.osvdb.org/29911
http://www.osvdb.org/29912
http://www.osvdb.org/29913
http://www.osvdb.org/29914
http://www.osvdb.org/29915
http://www.securityfocus.com/bid/20573
http://www.vupen.com/english/advisories/2006/4052
https://exchange.xforce.ibmcloud.com/vulnerabilities/29578
https://www.exploit-db.com/exploits/2570

History

No history.

Projects

Sign in to view the affected projects.

MITRE

Status: PUBLISHED

Assigner: mitre

Published: 2006-10-18T19:00:00

Updated: 2024-08-07T19:48:30.114Z

Reserved: 2006-10-18T00:00:00

Link: CVE-2006-5392

Vulnrichment

No data.

NVD

Status : Deferred

Published: 2006-10-18T19:07:00.000

Modified: 2025-04-09T00:30:58.490

Link: CVE-2006-5392

Redhat

No data.

OpenCVE Enrichment

No data.

Weaknesses

NVD-CWE-Other

{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "datePublic": "2006-10-16T00:00:00", "descriptions": [{"lang": "en", "value": "Multiple PHP remote file inclusion vulnerabilities in OpenDock FullCore 4.4 and earlier allow remote attackers to execute arbitrary PHP code via a URL in the doc_directory parameter in (1) sw/index_sw.php; (2) cart.php, (3) lib_cart.php, (4) lib_read_cart.php, (5) lib_sys_cart.php, and (6) txt_info_cart.php in sw/lib_cart/; (7) comment.php, (8) find_comment.php, and (9) lib_comment.php in sw/lib_comment/; (10) sw/lib_find/find.php; and other unspecified PHP scripts."}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2017-10-18T16:57:01", "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre"}, "references": [{"name": "29913", "tags": ["vdb-entry", "x_refsource_OSVDB"], "url": "http://www.osvdb.org/29913"}, {"name": "29911", "tags": ["vdb-entry", "x_refsource_OSVDB"], "url": "http://www.osvdb.org/29911"}, {"name": "29909", "tags": ["vdb-entry", "x_refsource_OSVDB"], "url": "http://www.osvdb.org/29909"}, {"name": "29908", "tags": ["vdb-entry", "x_refsource_OSVDB"], "url": "http://www.osvdb.org/29908"}, {"name": "22410", "tags": ["third-party-advisory", "x_refsource_SECUNIA"], "url": "http://secunia.com/advisories/22410"}, {"name": "29910", "tags": ["vdb-entry", "x_refsource_OSVDB"], "url": "http://www.osvdb.org/29910"}, {"name": "29915", "tags": ["vdb-entry", "x_refsource_OSVDB"], "url": "http://www.osvdb.org/29915"}, {"name": "opendock-docdirectory-file-include(29578)", "tags": ["vdb-entry", "x_refsource_XF"], "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/29578"}, {"name": "29914", "tags": ["vdb-entry", "x_refsource_OSVDB"], "url": "http://www.osvdb.org/29914"}, {"name": "2570", "tags": ["exploit", "x_refsource_EXPLOIT-DB"], "url": "https://www.exploit-db.com/exploits/2570"}, {"name": "29907", "tags": ["vdb-entry", "x_refsource_OSVDB"], "url": "http://www.osvdb.org/29907"}, {"name": "29912", "tags": ["vdb-entry", "x_refsource_OSVDB"], "url": "http://www.osvdb.org/29912"}, {"name": "ADV-2006-4052", "tags": ["vdb-entry", "x_refsource_VUPEN"], "url": "http://www.vupen.com/english/advisories/2006/4052"}, {"name": "29906", "tags": ["vdb-entry", "x_refsource_OSVDB"], "url": "http://www.osvdb.org/29906"}, {"name": "20573", "tags": ["vdb-entry", "x_refsource_BID"], "url": "http://www.securityfocus.com/bid/20573"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "cve@mitre.org", "ID": "CVE-2006-5392", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "Multiple PHP remote file inclusion vulnerabilities in OpenDock FullCore 4.4 and earlier allow remote attackers to execute arbitrary PHP code via a URL in the doc_directory parameter in (1) sw/index_sw.php; (2) cart.php, (3) lib_cart.php, (4) lib_read_cart.php, (5) lib_sys_cart.php, and (6) txt_info_cart.php in sw/lib_cart/; (7) comment.php, (8) find_comment.php, and (9) lib_comment.php in sw/lib_comment/; (10) sw/lib_find/find.php; and other unspecified PHP scripts."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "29913", "refsource": "OSVDB", "url": "http://www.osvdb.org/29913"}, {"name": "29911", "refsource": "OSVDB", "url": "http://www.osvdb.org/29911"}, {"name": "29909", "refsource": "OSVDB", "url": "http://www.osvdb.org/29909"}, {"name": "29908", "refsource": "OSVDB", "url": "http://www.osvdb.org/29908"}, {"name": "22410", "refsource": "SECUNIA", "url": "http://secunia.com/advisories/22410"}, {"name": "29910", "refsource": "OSVDB", "url": "http://www.osvdb.org/29910"}, {"name": "29915", "refsource": "OSVDB", "url": "http://www.osvdb.org/29915"}, {"name": "opendock-docdirectory-file-include(29578)", "refsource": "XF", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/29578"}, {"name": "29914", "refsource": "OSVDB", "url": "http://www.osvdb.org/29914"}, {"name": "2570", "refsource": "EXPLOIT-DB", "url": "https://www.exploit-db.com/exploits/2570"}, {"name": "29907", "refsource": "OSVDB", "url": "http://www.osvdb.org/29907"}, {"name": "29912", "refsource": "OSVDB", "url": "http://www.osvdb.org/29912"}, {"name": "ADV-2006-4052", "refsource": "VUPEN", "url": "http://www.vupen.com/english/advisories/2006/4052"}, {"name": "29906", "refsource": "OSVDB", "url": "http://www.osvdb.org/29906"}, {"name": "20573", "refsource": "BID", "url": "http://www.securityfocus.com/bid/20573"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-07T19:48:30.114Z"}, "title": "CVE Program Container", "references": [{"name": "29913", "tags": ["vdb-entry", "x_refsource_OSVDB", "x_transferred"], "url": "http://www.osvdb.org/29913"}, {"name": "29911", "tags": ["vdb-entry", "x_refsource_OSVDB", "x_transferred"], "url": "http://www.osvdb.org/29911"}, {"name": "29909", "tags": ["vdb-entry", "x_refsource_OSVDB", "x_transferred"], "url": "http://www.osvdb.org/29909"}, {"name": "29908", "tags": ["vdb-entry", "x_refsource_OSVDB", "x_transferred"], "url": "http://www.osvdb.org/29908"}, {"name": "22410", "tags": ["third-party-advisory", "x_refsource_SECUNIA", "x_transferred"], "url": "http://secunia.com/advisories/22410"}, {"name": "29910", "tags": ["vdb-entry", "x_refsource_OSVDB", "x_transferred"], "url": "http://www.osvdb.org/29910"}, {"name": "29915", "tags": ["vdb-entry", "x_refsource_OSVDB", "x_transferred"], "url": "http://www.osvdb.org/29915"}, {"name": "opendock-docdirectory-file-include(29578)", "tags": ["vdb-entry", "x_refsource_XF", "x_transferred"], "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/29578"}, {"name": "29914", "tags": ["vdb-entry", "x_refsource_OSVDB", "x_transferred"], "url": "http://www.osvdb.org/29914"}, {"name": "2570", "tags": ["exploit", "x_refsource_EXPLOIT-DB", "x_transferred"], "url": "https://www.exploit-db.com/exploits/2570"}, {"name": "29907", "tags": ["vdb-entry", "x_refsource_OSVDB", "x_transferred"], "url": "http://www.osvdb.org/29907"}, {"name": "29912", "tags": ["vdb-entry", "x_refsource_OSVDB", "x_transferred"], "url": "http://www.osvdb.org/29912"}, {"name": "ADV-2006-4052", "tags": ["vdb-entry", "x_refsource_VUPEN", "x_transferred"], "url": "http://www.vupen.com/english/advisories/2006/4052"}, {"name": "29906", "tags": ["vdb-entry", "x_refsource_OSVDB", "x_transferred"], "url": "http://www.osvdb.org/29906"}, {"name": "20573", "tags": ["vdb-entry", "x_refsource_BID", "x_transferred"], "url": "http://www.securityfocus.com/bid/20573"}]}]}, "cveMetadata": {"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "cveId": "CVE-2006-5392", "datePublished": "2006-10-18T19:00:00", "dateReserved": "2006-10-18T00:00:00", "dateUpdated": "2024-08-07T19:48:30.114Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:opendoc:fullcore:*:*:*:*:*:*:*:*", "matchCriteriaId": "4D372E49-407D-458A-B02F-D64C36D87DDD", "versionEndIncluding": "4.4", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Multiple PHP remote file inclusion vulnerabilities in OpenDock FullCore 4.4 and earlier allow remote attackers to execute arbitrary PHP code via a URL in the doc_directory parameter in (1) sw/index_sw.php; (2) cart.php, (3) lib_cart.php, (4) lib_read_cart.php, (5) lib_sys_cart.php, and (6) txt_info_cart.php in sw/lib_cart/; (7) comment.php, (8) find_comment.php, and (9) lib_comment.php in sw/lib_comment/; (10) sw/lib_find/find.php; and other unspecified PHP scripts."}, {"lang": "es", "value": "M\u00faltiples vulnerabilidades de inclusi\u00f3n remota de archivos de PHP en OpenDock FullCore 4.4 y anteriores, permite a los atacantes remotos la ejecuci\u00f3n de c\u00f3digo PHP de su elecci\u00f3n mediante una URL en el par\u00e1metro doc_directory en (1) sw/index_sw.php; (2) cart.php, (3) lib_cart.php, (4) lib_read_cart.php, (5) lib_sys_cart.php, y (6) txt_info_cart.php en sw/lib_cart/; (7) comment.php, (8) find_comment.php, y (9) lib_comment.php en sw/lib_comment/; (10) sw/lib_find/find.php; y otras secuencias de comandos en PHP no especificadas."}], "id": "CVE-2006-5392", "lastModified": "2025-04-09T00:30:58.490", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "HIGH", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 7.5, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": true, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}]}, "published": "2006-10-18T19:07:00.000", "references": [{"source": "cve@mitre.org", "url": "http://secunia.com/advisories/22410"}, {"source": "cve@mitre.org", "url": "http://www.osvdb.org/29906"}, {"source": "cve@mitre.org", "url": "http://www.osvdb.org/29907"}, {"source": "cve@mitre.org", "url": "http://www.osvdb.org/29908"}, {"source": "cve@mitre.org", "url": "http://www.osvdb.org/29909"}, {"source": "cve@mitre.org", "url": "http://www.osvdb.org/29910"}, {"source": "cve@mitre.org", "url": "http://www.osvdb.org/29911"}, {"source": "cve@mitre.org", "url": "http://www.osvdb.org/29912"}, {"source": "cve@mitre.org", "url": "http://www.osvdb.org/29913"}, {"source": "cve@mitre.org", "url": "http://www.osvdb.org/29914"}, {"source": "cve@mitre.org", "url": "http://www.osvdb.org/29915"}, {"source": "cve@mitre.org", "tags": ["Exploit"], "url": "http://www.securityfocus.com/bid/20573"}, {"source": "cve@mitre.org", "url": "http://www.vupen.com/english/advisories/2006/4052"}, {"source": "cve@mitre.org", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/29578"}, {"source": "cve@mitre.org", "url": "https://www.exploit-db.com/exploits/2570"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://secunia.com/advisories/22410"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.osvdb.org/29906"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.osvdb.org/29907"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.osvdb.org/29908"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.osvdb.org/29909"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.osvdb.org/29910"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.osvdb.org/29911"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.osvdb.org/29912"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.osvdb.org/29913"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.osvdb.org/29914"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.osvdb.org/29915"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit"], "url": "http://www.securityfocus.com/bid/20573"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.vupen.com/english/advisories/2006/4052"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/29578"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://www.exploit-db.com/exploits/2570"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-Other"}], "source": "nvd@nist.gov", "type": "Primary"}]}