CVE-2006-4990
- State
- Published
- Severity
- Not scored
- Published
- Sep 26, 2006
- Updated
- Aug 7, 2024
- Reserved
- Sep 25, 2006
Description
Multiple PHP remote file inclusion vulnerabilities in PhotoPost allow remote attackers to execute arbitrary PHP code via a URL in the PP_PATH parameter in (1) addfav.php, (2) adm-admlog.php, (3) adm-approve.php, (4) adm-backup.php, (5) adm-cats.php, (6) adm-cinc.php, (7) adm-db.php, (8) adm-editcfg.php, (9) adm-inc.php, (10) adm-index.php, (11) adm-modcom.php, (12) adm-move.php, (13) adm-options.php, (14) adm-order.php, (15) adm-pa.php, (16) adm-photo.php, (17) adm-purge.php, (18) adm-style.php, (19) adm-templ.php, (20) adm-userg.php, (21) adm-users.php, (22) bulkupload.php, (23) cookies.php, (24) comments.php, (25) ecard.php, (26) editphoto.php, (27) register.php, (28) showgallery.php, (29) showmembers.php, (30) useralbums.php, (31) uploadphoto.php, (32) search.php, or (33) adm-menu.php, different vectors than CVE-2006-4828.
Scores
The record has no CVSS score.
Weaknesses
The record names no weakness.
Affected Products
| Product | Versions |
|---|---|
n/an/a |
|
References
- 32240vdb-entry
- 32253vdb-entry
- 32233vdb-entry
- 32247vdb-entry
- 32230vdb-entry
- 32252vdb-entry
- 32245vdb-entry
- 32223vdb-entry
- 32250vdb-entry
- 32227vdb-entry
- 32237vdb-entry
- 20060918 PhotoPost PHP 4.6 - 4.5 [PP_PATH] >> Remote File Include Vulnerabilitymailing-list
- 32222vdb-entry
- 32248vdb-entry
- 32231vdb-entry
- 32246vdb-entry
- 32228vdb-entry
- 32221vdb-entry
- 32232vdb-entry
- 32234vdb-entry
- 32249vdb-entry
- 1632third-party-advisory
- 32239vdb-entry
- 32235vdb-entry
- 32229vdb-entry
- 32226vdb-entry
- 32236vdb-entry
- 32243vdb-entry
- 32224vdb-entry
- 32251vdb-entry
- 32238vdb-entry
- 32225vdb-entry
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.