CVE-2006-3584 Code injection in n/a
Remote attackers can execute arbitrary code or escalate privileges by injecting PHP variable variables via URL parameters in Jetbox CMS.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2006-3584?
CVE-2006-3584 is a high-severity code injection vulnerability in n/a, published on 8 Aug 2006. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Dynamic variable evaluation vulnerability in index.php in Jetbox CMS 2.1 SR1 allows remote attackers to overwrite configuration variables via URL parameters, which are evaluated as PHP variable variables.
Which versions are affected by CVE-2006-3584?
It affects 1 product.
Products include Jetbox Jetbox Cms.
How do I fix CVE-2006-3584?
No fix has been published for CVE-2006-3584 yet. Limit exposure of the affected software until one is available.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2006-3584 being exploited?
There is no known exploitation of CVE-2006-3584 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as GHSA-r6cw-ghwx-qhxj.