CVE-2006-52321 exploit
Multiple PHP remote file inclusion vulnerabilities in iSearch 2.16 allow remote attackers to execute arbitrary PHP code via a URL in the is…
Published 20 y ago · modified 4 mo ago · JSON
Summary
Multiple PHP remote file inclusion vulnerabilities in iSearch 2.16 allow remote attackers to execute arbitrary PHP code via a URL in the isearch_path parameter in (1) index.php, (2) viewcache.php, (3) sitemap.php, (4) isearch.inc.php, (5) google_sitemap.php, (6) stats.php, or (7) auto_spider_img.php. NOTE: this issue has been disputed by a third party who shows that $isearch_path is set to a constant value. CVE analysis as of 20061010 is inconclusive, although the original researcher is known to make mistakes
Exploit prediction (EPSS)
2.83% probability of exploitation in the next 30 days, higher than 87% of all scored CVEs.
Exploits and detections
- EDB-28772 ISearch 2.16 - 'ISEARCH_PATH' Remote File Inclusion · webapps · 2006-10-09
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| NVD | 2.0 | 7.5 | AV:N/AC:L/Au:N/C:P/I:P/A:P |
References
- exchange.xforce.ibmcloud.com /vulnerabilities/29402 · vdb-entry, x_refsource_XF, x_transferred
- securityfocus.com /archive/1/448225/100/100/threaded · mailing-list, x_refsource_BUGTRAQ, x_transferred
- securityfocus.com /archive/1/448099/100/0/threaded · mailing-list, x_refsource_BUGTRAQ, x_transferred
- securityfocus.com /archive/1/448006/100/0/threaded · mailing-list, x_refsource_BUGTRAQ, x_transferred
- securityfocus.com /bid/20401 · vdb-entry, x_refsource_BID, x_transferred
Sources
- CVE List: CVE-2006-5232
- NVD: CVE-2006-5232
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.