CVE-2006-5621

{"id": "CVE-2006-5621", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 7.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": true, "userInteractionRequired": false}]}, "published": "2006-10-31T20:07:00.000", "references": [{"url": "http://rave.jk-digital.com/blog/2006/12/08/ask_rave-09b-released/", "tags": ["Patch"], "source": "cve@mitre.org"}, {"url": "http://www.securityfocus.com/bid/20758", "tags": ["Exploit"], "source": "cve@mitre.org"}, {"url": "http://www.vupen.com/english/advisories/2006/4211", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/29825", "source": "cve@mitre.org"}, {"url": "https://www.exploit-db.com/exploits/2654", "source": "cve@mitre.org"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-94"}]}], "descriptions": [{"lang": "en", "value": "PHP remote file inclusion vulnerability in end.php in ask_rave 0.9 PR, and other versions before 0.9b, allows remote attackers to execute arbitrary PHP code via a URL in the footfile parameter."}, {"lang": "es", "value": "Vulnerabilidad de inclusi\u00f3n remota de archivo en PHP en end.php de ask_rave 0.9 PR, y otras versiones anteriores a 0.9b, permite a atacantes remotos ejecutar c\u00f3digo PHP de su elecci\u00f3n mediante un URL en par\u00e1metro footfile."}], "lastModified": "2017-10-19T01:29:38.067", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:ask_rave:ask_rave:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "DB0B18D3-FC28-4349-AE50-F8C56B05F579", "versionEndIncluding": "0.9_pr"}], "operator": "OR"}]}], "vendorComments": [{"comment": "Ask_rave 0.9b has been released for immediate download and versions 0.9PR and below have been rendered obsolete. All users using versions 0.9PR and prior are recommended to upgrade their versions immediately. Users can use the following URI to download this new version: http://rave.jk-digital.com/site/scripts/ask.php", "lastModified": "2006-12-12T00:00:00", "organization": "Rave"}], "sourceIdentifier": "cve@mitre.org", "evaluatorSolution": "This vulnerability is addressed in the following product update:\r\nask_rave, ask_rave, 0.9b"}