Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2006-2245

Quick assessment

Affected
n/a n/a
Exploitation
High exploitation probability; assess promptly
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

phpBB是一种用PHP语言实现的基于Web脚本的开放源码论坛程序，使用较为广泛。 phpBB的Auction模块实现上输入验证漏洞，远程攻击者可以利用此漏洞在主机上执行任意命令。 Auction模块没有正确检查过滤用户在变量phpbb_root_path中提交的参数值，远程攻击者可以在数据中插入特定字串使脚本包含远程服务器上的PHP脚本代码并执行，使攻击者能以Web进程权限在服务器上执行任意命令。

AI Predicted 9.8 Difficulty: Trivial EPSS 7.56% · P94

Public Exploits 1

ExploitDB · 1 EDB-1747 [webapps]
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2006-2245

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
N/A
Source: CVE Program / CVE List V5
Vulnerability Description
PHP remote file inclusion vulnerability in auction\auction_common.php in Auction mod 1.3m for phpBB allows remote attackers to execute arbitrary PHP code via a URL in the phpbb_root_path parameter.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
phpBB Auction模块 远程文件包含漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
phpBB是一种用PHP语言实现的基于Web脚本的开放源码论坛程序，使用较为广泛。 phpBB的Auction模块实现上输入验证漏洞，远程攻击者可以利用此漏洞在主机上执行任意命令。 Auction模块没有正确检查过滤用户在变量phpbb_root_path中提交的参数值，远程攻击者可以在数据中插入特定字串使脚本包含远程服务器上的PHP脚本代码并执行，使攻击者能以Web进程权限在服务器上执行任意命令。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
- n/a n/a -

II. Public POCs for CVE-2006-2245

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2006-2245

请登录查看更多情报信息。

Vendor Advisories for CVE-2006-2245 (5)

Other References for CVE-2006-2245 (1)

Same Patch Batch · n/a · 2006-05-09 · 66 CVEs total

CVE-2006-2248 Xeneo Web Server 文件扩展名 信息泄露漏洞
CVE-2006-2267 Kerio WinRoute 防火墙 协议检测模块 拒绝服务漏洞
CVE-2006-2266 Chirpy! 未明SQL注入漏洞
CVE-2006-2265 Ocean12 Calendar Manager Pro main.asp 跨站脚本攻击漏洞
CVE-2006-2254 FileCOPA filecpnt.exe 缓冲区溢出
CVE-2006-2253 StatIt Visible_count_inc.PHP 远程文件包含漏洞
CVE-2006-2252 OpenFAQ submit.php 跨站脚本攻击漏洞
CVE-2006-2251 Invision Community Blog mod.php 远程SQL注入漏洞
CVE-2006-2250 CuteNews 多个信息泄露漏洞
CVE-2006-2249 CuteNews search.php 多个跨站脚本攻击漏洞
CVE-2006-2255 Creative Community Portal 多个SQL注入漏洞
CVE-2006-2247 WebCalendar 出错信息 用户名枚举漏洞
CVE-2006-2246 UBlog Access Edition blog条目 跨站脚本攻击 (XSS)漏洞
CVE-2006-2244 Web4Future News Portal 多个SQL注入漏洞
CVE-2006-2243 Web4Future News Portal 多个跨站脚本攻击 (XSS) 漏洞
CVE-2006-2242 acFTP USER命令 远程拒绝服务漏洞
CVE-2006-2241 Fast Click SQL Lite Show.PHP 远程文件包含漏洞
CVE-2006-2240 Fujitsu NetShelter/FW 未明拒绝服务漏洞
CVE-2006-2239 Newsadmin Readarticle.PHP SQL注入漏洞
CVE-2006-2161 TZipBuilder ZIP文件名处理 多个缓冲区溢出漏洞

Showing top 20 of 66 CVEs. View all on vendor page → →

IV. Related Vulnerabilities

Same product: n/a
Same vendor: n/a

V. Comments for CVE-2006-2245

No comments yet

Leave a comment