CVE-2006-6549 File upload in n/a
Remote attackers can execute arbitrary PHP code via a URL in the save_path parameter of upload.php in Rad Upload.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2006-6549?
CVE-2006-6549 is a high-severity vulnerability in n/a, published on 14 Dec 2006. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
PHP remote file inclusion vulnerability in upload.php in Rad Upload 3.02 allows remote attackers to execute arbitrary PHP code via a URL in the save_path parameter. NOTE: CVE disputes this vulnerability because save_path is originally defined as "" before use, and the nearby instructions say "SET THE SAVE PATH by editing the line below.
Which versions are affected by CVE-2006-6549?
It affects 1 product.
Products include Rad Inks Rad Upload.
How do I fix CVE-2006-6549?
No fix has been published for CVE-2006-6549 yet. Limit exposure of the affected software until one is available.
Is CVE-2006-6549 being exploited?
There is no known exploitation of CVE-2006-6549 in the wild and no public exploit code.
Sources
Also known as GHSA-5mhq-fm5h-pfx5.