Vulnerabilities > CVE-2006-3421 - Remote File Include vulnerability in SmartSiteCMS

047910
CVSS 5.1 - MEDIUM
Attack vector
NETWORK
Attack complexity
HIGH
Privileges required
NONE
Confidentiality impact
PARTIAL
Integrity impact
PARTIAL
Availability impact
PARTIAL
network
high complexity
smartsitecms
exploit available
NVD
Published: 2006-07-07
Updated: 2018-10-18

Summary

PHP remote file inclusion vulnerability in SmartSiteCMS 1.0 and earlier, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via the root parameter in (1) comment.php, (2) admin/comedit.php, (3) admin/test.php, (4) admin/index.php, and (5) admin/include/inc_adminfoot.php, a different set of vectors than CVE-2006-3162.

Vulnerable Configurations

Part Description Count
Application
Smartsitecms
1

Exploit-Db

  • descriptionSmartSiteCMS 1.0 (root) Multiple Remote File Inclusion Vulnerabilities. CVE-2006-3421. Webapps exploit for php platform
    idEDB-ID:1974
    last seen2016-01-31
    modified2006-07-01
    published2006-07-01
    reporterCrAsh_oVeR_rIdE
    sourcehttps://www.exploit-db.com/download/1974/
    titleSmartSiteCMS 1.0 root Multiple Remote File Inclusion Vulnerabilities
  • descriptionSmartSiteCMS 1.0 (root) Remote File Inclusion Vulnerability. CVE-2006-3162,CVE-2006-3421. Webapps exploit for php platform
    fileexploits/php/webapps/1936.txt
    idEDB-ID:1936
    last seen2016-01-31
    modified2006-06-20
    platformphp
    port
    published2006-06-20
    reporterArchit3ct
    sourcehttps://www.exploit-db.com/download/1936/
    titleSmartSiteCMS 1.0 root Remote File Inclusion Vulnerability
    typewebapps

References