CVE-2006-2859 Code injection in n/a
Remote attackers could execute arbitrary PHP code via URL parameters, though the vulnerability is disputed and may not exist in the core code.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2006-2859?
CVE-2006-2859 is a high-severity code injection vulnerability in n/a, published on 6 Jun 2006. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
PHP remote file inclusion vulnerability in MyBloggie 2.1.1 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the mybloggie_root_path parameter to (1) admin.php or (2) scode.php. NOTE: this issue has been disputed in multiple third party followups, which say that the MyBloggie source code does not demonstrate the issue, so it might be the result of another module. CVE analysis as of 20060605 agrees with the dispute. In addition, scode.php is not part of the MyBloggie distribution
Which versions are affected by CVE-2006-2859?
It affects 1 product.
Products include Mywebland Mybloggie.
How do I fix CVE-2006-2859?
No fix has been published for CVE-2006-2859 yet. Limit exposure of the affected software until one is available.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2006-2859 being exploited?
There is no known exploitation of CVE-2006-2859 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as GHSA-v287-828q-jwgf.