CVE-2006-0565

Published: Feb 6, 2006Modified: Apr 16, 2026

7.5

Vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Exploitability: 10.0 / Impact: 6.4

Source: NVD

Description

PHP remote file include vulnerability in inc/backend_settings.php in Loudblog 0.4 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the $GLOBALS[path] parameter.

Affected (4)

Products: Gerrit Van Aaken: Loudblog

Gerrit Van Aaken

1 product

Loudblog

Configuration A

4 vulnerable

Vulnerable Software	Affected Versions
Gerrit Van Aaken Loudblog	Up to 0.4
Gerrit Van Aaken Loudblog	Version 0.1
Gerrit Van Aaken Loudblog	Version 0.2
Gerrit Van Aaken Loudblog	Version 0.3

Related CWEs

CWE-94

Improper Control of Generation of Code ('Code Injection')

The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

References (20)

http://retrogod.altervista.org/loudblog_04_incl_xpl.html

Source: cve@mitre.org

Exploit

http://secunia.com/advisories/18722

Source: cve@mitre.org

Vendor Advisory

http://securityreason.com/securityalert/410

Source: cve@mitre.org

http://securityreason.com/securityalert/556

Source: cve@mitre.org

http://securitytracker.com/id?1015583

Source: cve@mitre.org

http://www.osvdb.org/22921

Source: cve@mitre.org

http://www.securityfocus.com/archive/1/423947/100/0/threaded

Source: cve@mitre.org

http://www.securityfocus.com/bid/16495

Source: cve@mitre.org

http://www.vupen.com/english/advisories/2006/0441

Source: cve@mitre.org

Vendor Advisory

https://exchange.xforce.ibmcloud.com/vulnerabilities/24479

Source: cve@mitre.org

http://retrogod.altervista.org/loudblog_04_incl_xpl.html