vulnwire
7.5high

CVE-2006-3771in critical feed1 exploit

Multiple PHP remote file inclusion vulnerabilities in component.php in iManage CMS 4.0.12 and earlier allow remote attackers to execute arb…

Published 20 y ago · modified 4 mo ago · JSON

CVSS
7.5
v2.0 · NVD
CISA KEV
No
not known exploited
EPSS
16.3%
percentile 97%
Public exploits
1
Exploit-DB

Multiple PHP remote file inclusion vulnerabilities in component.php in iManage CMS 4.0.12 and earlier allow remote attackers to execute arbitrary PHP code via a URL in the absolute_path parameter to (1) articles.php, (2) contact.php, (3) displaypage.php, (4) faq.php, (5) mainbody.php, (6) news.php, (7) registration.php, (8) whosOnline.php, (9) components/com_calendar.php, (10) components/com_forum.php, (11) components/minibb/index.php, (12) components/minibb/bb_admin.php, (13) components/minibb/bb_plugins.php, (14) modules/mod_calendar.php, (15) modules/mod_browser_prefs.php, (16) modules/mod_counter.php, (17) modules/mod_online.php, (18) modules/mod_stats.php, (19) modules/mod_weather.php, (20) themes/bizz.php, (21) themes/default.php, (22) themes/simple.php, (23) themes/original.php, (24) themes/portal.php, (25) themes/purple.php, and other unspecified files.

Exploit prediction (EPSS)

16.32% probability of exploitation in the next 30 days, higher than 97% of all scored CVEs.

Exploits and detections

  • EDB-2046 iManage CMS 4.0.12 - 'absolute_path' Remote File Inclusion · webapps · 2006-07-20

CVSS scores

Assigned byVersionScoreVector
NVD2.07.5AV:N/AC:L/Au:N/C:P/I:P/A:P

References

  • osvdb.org /28652 · vdb-entry, x_refsource_OSVDB, x_transferred
  • osvdb.org /28665 · vdb-entry, x_refsource_OSVDB, x_transferred
  • osvdb.org /28661 · vdb-entry, x_refsource_OSVDB, x_transferred
  • securityfocus.com /archive/1/440642/100/0/threaded · mailing-list, x_refsource_BUGTRAQ, x_transferred
  • osvdb.org /28654 · vdb-entry, x_refsource_OSVDB, x_transferred
  • osvdb.org /28670 · vdb-entry, x_refsource_OSVDB, x_transferred
  • osvdb.org /28653 · vdb-entry, x_refsource_OSVDB, x_transferred
  • securityfocus.com /bid/19090 · vdb-entry, x_refsource_BID, x_transferred
  • osvdb.org /28655 · vdb-entry, x_refsource_OSVDB, x_transferred
  • osvdb.org /28663 · vdb-entry, x_refsource_OSVDB, x_transferred
  • osvdb.org /28660 · vdb-entry, x_refsource_OSVDB, x_transferred
  • osvdb.org /28651 · vdb-entry, x_refsource_OSVDB, x_transferred
  • osvdb.org /28648 · vdb-entry, x_refsource_OSVDB, x_transferred
  • osvdb.org /28671 · vdb-entry, x_refsource_OSVDB, x_transferred
  • osvdb.org /28649 · vdb-entry, x_refsource_OSVDB, x_transferred
  • securitytracker.com /id?1016551 · vdb-entry, x_refsource_SECTRACK, x_transferred
  • osvdb.org /28669 · vdb-entry, x_refsource_OSVDB, x_transferred
  • osvdb.org /28656 · vdb-entry, x_refsource_OSVDB, x_transferred
  • osvdb.org /28664 · vdb-entry, x_refsource_OSVDB, x_transferred
  • osvdb.org /28647 · vdb-entry, x_refsource_OSVDB, x_transferred
  • osvdb.org /28658 · vdb-entry, x_refsource_OSVDB, x_transferred
  • osvdb.org /28668 · vdb-entry, x_refsource_OSVDB, x_transferred
  • osvdb.org /28662 · vdb-entry, x_refsource_OSVDB, x_transferred
  • securityreason.com /securityalert/1265 · third-party-advisory, x_refsource_SREASON, x_transferred
  • exchange.xforce.ibmcloud.com /vulnerabilities/27875 · vdb-entry, x_refsource_XF, x_transferred
  • exploit-db.com /exploits/2046 · exploit, x_refsource_EXPLOIT-DB, x_transferred
  • osvdb.org /28659 · vdb-entry, x_refsource_OSVDB, x_transferred
  • osvdb.org /28650 · vdb-entry, x_refsource_OSVDB, x_transferred
  • advisories.echo.or.id /adv/adv40-matdhule-2006.txt · x_refsource_MISC, x_transferred
  • osvdb.org /28667 · vdb-entry, x_refsource_OSVDB, x_transferred
  • osvdb.org /28657 · vdb-entry, x_refsource_OSVDB, x_transferred
  • osvdb.org /28666 · vdb-entry, x_refsource_OSVDB, x_transferred

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.