CVE-2006-7124

PHP remote file inclusion vulnerability in external/rssfeeds.php in BSQ Sitestats (component for Joomla) 1.8.0, and possibly other versions before 2.2.1, allows remote attackers to execute arbitrary PHP code via the baseDir parameter.

CVSS v2.0 7.5 HIGH

7.5^/10

CVSS v2.0 : HIGH

Vector : AV:N/AC:L/Au:N/C:P/I:P/A:P

Exploitability : 10.0 / Impact : 6.4

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
http://secunia.com/secunia_research/2006-63/advisory/	Patch Vendor Advisory
http://developer.joomla.org/sf/sfmain/do/viewProject/projects.bsq_sitestats
http://www.securityfocus.com/bid/20267	Patch
http://www.osvdb.org/29287	Patch
http://securityreason.com/securityalert/2360
https://exchange.xforce.ibmcloud.com/vulnerabilities/29269
http://www.securityfocus.com/archive/1/447356/100/0/threaded

Configurations

Configuration 1 (hide)

cpe:2.3:a:joomla:bsq_sitestats:1.8.0:*:*:*:*:*:*:*

Information

Published : 2007-03-06 01:19

Updated : 2018-10-16 16:29

NVD link : CVE-2006-7124

Mitre link : CVE-2006-7124

JSON object : View

Products Affected

joomla

bsq_sitestats

CWE

NVD-CWE-Other

{"cve": {"data_type": "CVE", "references": {"reference_data": [{"url": "http://secunia.com/secunia_research/2006-63/advisory/", "name": "http://secunia.com/secunia_research/2006-63/advisory/", "tags": ["Patch", "Vendor Advisory"], "refsource": "MISC"}, {"url": "http://developer.joomla.org/sf/sfmain/do/viewProject/projects.bsq_sitestats", "name": "http://developer.joomla.org/sf/sfmain/do/viewProject/projects.bsq_sitestats", "tags": [], "refsource": "CONFIRM"}, {"url": "http://www.securityfocus.com/bid/20267", "name": "20267", "tags": ["Patch"], "refsource": "BID"}, {"url": "http://www.osvdb.org/29287", "name": "29287", "tags": ["Patch"], "refsource": "OSVDB"}, {"url": "http://securityreason.com/securityalert/2360", "name": "2360", "tags": [], "refsource": "SREASON"}, {"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/29269", "name": "bsq-sitestats-rssfeeds-file-include(29269)", "tags": [], "refsource": "XF"}, {"url": "http://www.securityfocus.com/archive/1/447356/100/0/threaded", "name": "20060929 Secunia Research: Joomla BSQ Sitestats Component MultipleVulnerabilities", "tags": [], "refsource": "BUGTRAQ"}]}, "data_format": "MITRE", "description": {"description_data": [{"lang": "en", "value": "PHP remote file inclusion vulnerability in external/rssfeeds.php in BSQ Sitestats (component for Joomla) 1.8.0, and possibly other versions before 2.2.1, allows remote attackers to execute arbitrary PHP code via the baseDir parameter."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "en", "value": "NVD-CWE-Other"}]}]}, "data_version": "4.0", "CVE_data_meta": {"ID": "CVE-2006-7124", "ASSIGNER": "cve@mitre.org"}}, "impact": {"baseMetricV2": {"cvssV2": {"version": "2.0", "baseScore": 7.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "severity": "HIGH", "impactScore": 6.4, "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": true, "userInteractionRequired": false}}, "publishedDate": "2007-03-06T01:19Z", "configurations": {"nodes": [{"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:a:joomla:bsq_sitestats:1.8.0:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}]}], "CVE_data_version": "4.0"}, "lastModifiedDate": "2018-10-16T16:29Z"}