CVE-2006-1154

Published: Mar 10, 2006Modified: Apr 16, 2026

7.5

Vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Exploitability: 10.0 / Impact: 6.4

Source: NVD

Description

PHP remote file inclusion vulnerability in archive.php in Fantastic News 2.1.2 allows remote attackers to include arbitrary files via the CONFIG[script_path] variable. NOTE: 2.1.4 was also reported to be vulnerable.

Affected (3)

Products: Fscripts: Fantastic News

Fscripts

1 product

Fantastic News

Configuration A

3 vulnerable

Vulnerable Software	Affected Versions
Fscripts Fantastic News	Version 2.1.1
Fscripts Fantastic News	Version 2.1.2
Fscripts Fantastic News	Version 2.1.4

Related CWEs

CWE-94

Improper Control of Generation of Code ('Code Injection')

The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

References (20)

http://secunia.com/advisories/21807

Source: cve@mitre.org

Vendor Advisory

http://secunia.com/advisories/23519

Source: cve@mitre.org

http://sx02.coresec.de/advisories/152.txt

Source: cve@mitre.org

http://www.securityfocus.com/bid/16985

Source: cve@mitre.org

http://www.securityfocus.com/bid/21796

Source: cve@mitre.org

http://www.vupen.com/english/advisories/2006/0826

Source: cve@mitre.org

http://www.vupen.com/english/advisories/2006/3513

Source: cve@mitre.org

Vendor Advisory

https://exchange.xforce.ibmcloud.com/vulnerabilities/25064

Source: cve@mitre.org

https://exchange.xforce.ibmcloud.com/vulnerabilities/31121

Source: cve@mitre.org

https://www.exploit-db.com/exploits/3027

Source: cve@mitre.org

http://secunia.com/advisories/21807