Remote File Inclusion Vulnerabilities in Free File Hosting by Free Image Hosting
CVE-2006-5763

Currently unrated

Key Information:

Vendor

Free PHP Scripts

Status
Free File Hosting
Free Image Hosting
Vendor
CVE Published:
6 November 2006

Badges

👾 Exploit Exists🟣 EPSS 21%

What is CVE-2006-5763?

Multiple PHP remote file inclusion vulnerabilities exist in Free File Hosting 1.1, and potentially earlier versions, specifically when the register_globals setting is enabled. These flaws permit unauthorized remote attackers to execute arbitrary PHP code through a URL input in the AD_BODY_TEMP parameter, targeting scripts such as login.php, register.php, and send.php. This vulnerability also extends to the File Upload System, which is integrated into Free File Hosting, and is similarly present in Free Image Hosting 2.0. Attackers can exploit this weakness to gain control over the affected server.

References

http://www.attrition.org/pipermail/vim/2007-March/001473....
mailing-listx_refsource_VIM
http://www.osvdb.org/30146
vdb-entryx_refsource_OSVDB
http://secunia.com/advisories/22594
third-party-advisoryx_refsource_SECUNIA

EPSS Score

21% chance of being exploited in the next 30 days.

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

.