CVE-2006-2859: High severity myWebland myBloggie vulnerability
DISPUTED PHP remote file inclusion vulnerability in MyBloggie 2.1.1 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the mybloggierootpath parameter to (1) admin.php or (2) scode.php. NOTE: this issue has been disputed in multiple third party followups, which say that the MyBloggie source code does not demonstrate the issue, so it might be the result of another module. CVE analysis as of 20060605 agrees with the dispute. In addition, scode.php is not part of the MyBloggie distribution.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2006-2859?
CVE-2006-2859 is classified as a remote file inclusion vulnerability which can lead to arbitrary code execution.
How do I fix CVE-2006-2859?
To fix CVE-2006-2859, upgrade to a patched version of MyBloggie that addresses the vulnerability.
What software versions are affected by CVE-2006-2859?
CVE-2006-2859 affects MyBloggie version 2.1.1 and earlier.
Can CVE-2006-2859 lead to data compromise?
Yes, successful exploitation of CVE-2006-2859 can allow attackers to execute arbitrary PHP code, potentially compromising sensitive data.
How can I determine if my MyBloggie installation is vulnerable to CVE-2006-2859?
If you are running MyBloggie version 2.1.1 or earlier, your installation is vulnerable to CVE-2006-2859.