ByteOS Network

NVD Vulnerability Details :

CVE-2006-5621

Modified

Source-cve@mitre.org

Published At-31 Oct, 2006 | 20:07

Updated At-19 Oct, 2017 | 01:29

PHP remote file inclusion vulnerability in end.php in ask_rave 0.9 PR, and other versions before 0.9b, allows remote attackers to execute arbitrary PHP code via a URL in the footfile parameter.

Date Added	Due Date	Vulnerability Name	Required Action
	N/A

Metrics

Type	Version	Base score	Base severity	Vector
Primary	2.0	7.5	HIGH	AV:N/AC:L/Au:N/C:P/I:P/A:P

Type: Primary

Version: 2.0

Base score: 7.5

Base severity: HIGH

Vector:

AV:N/AC:L/Au:N/C:P/I:P/A:P

CPE Matches

ask_rave>>ask_rave>>Versions up to 0.9_pr(inclusive)

cpe:2.3:a:ask_rave:ask_rave:*:*:*:*:*:*:*:*

Weaknesses

CWE ID	Type	Source
CWE-94	Primary	nvd@nist.gov

CWE ID: CWE-94

Type: Primary

Source: nvd@nist.gov

Evaluator Solution

This vulnerability is addressed in the following product update: ask_rave, ask_rave, 0.9b

Vendor Statements

Organization : Rave

Last Modified : 2006-12-12T00:00:00

Ask_rave 0.9b has been released for immediate download and versions 0.9PR and below have been rendered obsolete. All users using versions 0.9PR and prior are recommended to upgrade their versions immediately. Users can use the following URI to download this new version: http://rave.jk-digital.com/site/scripts/ask.php

References

Hyperlink	Source	Resource
http://rave.jk-digital.com/blog/2006/12/08/ask_rave-09b-released/	cve@mitre.org	Patch
http://www.securityfocus.com/bid/20758	cve@mitre.org	Exploit
http://www.vupen.com/english/advisories/2006/4211	cve@mitre.org	Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/29825	cve@mitre.org	N/A
https://www.exploit-db.com/exploits/2654	cve@mitre.org	N/A