CVE-2006-3850

PHP remote file inclusion vulnerability in upgrader.php in Vanilla CMS 1.0.1 and earlier, when /conf/old_settings.php exists, allows remote attackers to…

published July 25, 2006

CVSS
—
EPSS
3%
Percentile
88.9
In the wild
Unconfirmed
What it is

PHP remote file inclusion vulnerability in upgrader.php in Vanilla CMS 1.0.1 and earlier, when /conf/old_settings.php exists, allows remote attackers to execute arbitrary PHP code via a URL in the RootDirectory parameter. NOTE: this issue has been disputed by a third party who states that the RootDirectory parameter is initialized before being used, for version 1.0. CVE analysis concurs with the dispute, but it is unclear whether older versions are affected

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.03449 · 88.9th percentile
Published
2006-07-25T23:00Z
EPSS history
Timeline
  • 25 JUL 23:00Z
    PHP remote file inclusion vulnerability in upgrader.php in Vanilla CMS 1.0.1 and earlier, when /conf/old_settings.php exists, allows remote attackers to…
    cvelistv5