National Cyber Awareness System

Vulnerability Summary for CVE-2006-2507

Overview

Multiple PHP remote file inclusion vulnerabilities in Teake Nutma Foing 0.2.0 through 0.7.0, as used with phpBB, allow remote attackers to execute arbitrary PHP code via a URL in the phpbb_root_path parameter in (1) index.php, (2) song.php, (3) faq.php, (4) list.php, (5) gen_m3u.php, and (6) playlist.php.

Impact

CVSS Severity (version 2.0 upgrade from v1.0):

CVSS Version 2 Metrics:

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov.

External Source: XF

Name: foing-phpbb-multiple-file-include(26425)

Hyperlink:http://xforce.iss.net/xforce/xfdb/26425

External Source: VUPEN

Name: ADV-2006-1793

Hyperlink:http://www.vupen.com/english/advisories/2006/1793

External Source: BID

Name: 17963

Hyperlink:http://www.securityfocus.com/bid/17963

External Source: BUGTRAQ

Name: 20060512 [Kurdish Security # 7] Foing Remote File Include Vulnerability [PHPBB]

Type: Advisory; Exploit

Hyperlink:http://www.securityfocus.com/archive/1/archive/1/433824/100/0/threaded

External Source: SECUNIA

Name: 20092

Type: Advisory; Exploit

Hyperlink:http://secunia.com/advisories/20092

External Source: MISC

Name: http://kurdishsecurity.blogspot.com/2006/05/kurdish-security-7-foing-remote-file.html

Type: Advisory; Exploit

Hyperlink:http://kurdishsecurity.blogspot.com/2006/05/kurdish-security-7-foing-remote-file.html

External Source: BUGTRAQ

Name: 20060529 Foing Remote File Include Vulnerability [PHPBB]

Hyperlink:http://www.securityfocus.com/archive/1/archive/1/435302/100/0/threaded

External Source: OSVDB

Name: 25564

Hyperlink:http://www.osvdb.org/25564

External Source: SREASON

Name: 932

Hyperlink:http://securityreason.com/securityalert/932