CVE-2006-7194

Current Description

PHP remote file inclusion vulnerability in modules/Mysqlfinder/MysqlfinderAdmin.php in Agora 1.4 RC1, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the _SESSION[PATH_COMPOSANT] parameter.

Basic Data

PublishedApril 18, 2007
Last ModifiedOctober 11, 2017
Assignercve@mitre.org
Data TypeCVE
Data FormatMITRE
Data Version4.0
Problem TypeNVD-CWE-Other
CVE Data Version4.0

Base Metric V2

CVSS 2 - Version2.0
CVSS 2 - Vector StringAV:N/AC:M/Au:N/C:P/I:P/A:P
CVSS 2 - Access VectorNETWORK
CVSS 2 - Access ComplexityMEDIUM
CVSS 2 - AuthenticationNONE
CVSS 2 - Confidentiality ImpactPARTIAL
CVSS 2 - Availability ImpactPARTIAL
CVSS 2 - Base Score6.8
SeverityMEDIUM
Exploitability Score8.6
Impact Score6.4
Obtain All Privilegefalse
Obtain User Privilegefalse
Obtain Other Privilegetrue

Base Metric V3

No data provided.

Configurations

  • OR - Configuration 1
    Cpe VersionPartVendorProductVersionUpdateEditionLanguageSW EditionTarget SWTarget HWOtherVersion Start IncludingVersion End IncludingVersion Start ExcludingVersion End Excluding
    2.3ApplicationRepublique FrancaiseAgora1.4_rc1*******

Vulnerable Software List

VendorProductVersions
Republique Francaise Agora 1.4_rc1

References

NameSourceURLTags
http://advisories.echo.or.id/adv/adv59-theday-2006.txthttp://advisories.echo.or.id/adv/adv59-theday-2006.txtMISC
20061106 [ECHO_ADV_59_2006]Agora 1.4 RC1 "$_SESSION[PATH_COMPOSANT]"http://marc.info/?l=bugtraq&m=116283849004075&w=2BUGTRAQ
agora-mysqlfinderadmin-file-include(30031)https://exchange.xforce.ibmcloud.com/vulnerabilities/30031XF
2726https://www.exploit-db.com/exploits/2726EXPLOIT-DB