PHP Remote File Inclusion Vulnerability in WebYep by Obdev

CVE-2006-5220

What is CVE-2006-5220?

WebYep 1.1.9 has multiple vulnerabilities related to remote file inclusion due to insecure handling of the 'webyep_sIncludePath' variable when 'register_globals' is enabled. This flaw allows remote attackers to exploit specific PHP files located in the 'programm/lib/' and 'programm/elements/' directories, as well as 'programm/webyep.php', leading to the possibility of executing arbitrary PHP code on the affected server. It highlights the critical need for web applications to implement secure coding practices and properly configure their settings to mitigate such risks.

References