Vulnerability Description
PHP remote file inclusion vulnerability in big.php in pearlabs mafia moblog 6 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the pathtotemplate parameter. NOTE: a third party claims that the researcher is incorrect, because template.php defines pathtotemplate before big.php uses pathtotemplate. CVE has not verified either claim, but during August 2006, the original researcher made several significant errors regarding this bug type
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Pearlabs | Mafia Moblog | <= 6 |
References
- http://securityreason.com/securityalert/1391
- http://www.securityfocus.com/archive/1/442867/100/0/threaded
- http://www.securityfocus.com/archive/1/443153/100/0/threaded
- http://www.securityfocus.com/bid/19458
- http://securityreason.com/securityalert/1391
- http://www.securityfocus.com/archive/1/442867/100/0/threaded
- http://www.securityfocus.com/archive/1/443153/100/0/threaded
- http://www.securityfocus.com/bid/19458
FAQ
What is CVE-2006-4156?
CVE-2006-4156 is a vulnerability with a CVSS score of 7.5 (HIGH). PHP remote file inclusion vulnerability in big.php in pearlabs mafia moblog 6 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the pathtotemplate parameter. NOTE: a thir...
How severe is CVE-2006-4156?
CVE-2006-4156 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2006-4156?
Check the references section above for vendor advisories and patch information. Affected products include: Pearlabs Mafia Moblog.