CVE-2006-0687

Published: Feb 15, 2006Modified: Apr 16, 2026

5.0

Vector

AV:N/AC:L/Au:N/C:N/I:P/A:N

Exploitability: 10.0 / Impact: 2.9

Source: NVD

Description

process.php in DocMGR 0.54.2 does not initialize the $siteModInfo variable when a direct request is made, which allows remote attackers to include arbitrary local files or possibly remote files via a modified includeModule and siteModInfo variable.

Affected (1)

Products: Docmgr: Docmgr

Docmgr

1 product

Docmgr

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Docmgr Docmgr	Version 0.54.2

References (14)

http://retrogod.altervista.org/docmgr_0542_incl_xpl.html

Source: cve@mitre.org

Exploit

http://secunia.com/advisories/18803

Source: cve@mitre.org

Vendor Advisory

http://securityreason.com/securityalert/428

Source: cve@mitre.org

http://www.securityfocus.com/archive/1/424818/100/0/threaded

Source: cve@mitre.org

http://www.securityfocus.com/bid/16601

Source: cve@mitre.org

http://www.vupen.com/english/advisories/2006/0544

Source: cve@mitre.org

https://exchange.xforce.ibmcloud.com/vulnerabilities/24694

Source: cve@mitre.org

http://retrogod.altervista.org/docmgr_0542_incl_xpl.html