CVE-2006-5494: Code Injection
Multiple PHP remote file inclusion vulnerabilities in modules/MyeGallery/public/displayCategory.php in the pandaBB module for PHP-Nuke allow remote attackers to execute arbitrary PHP code via a URL in the (1) adminpath or (2) basepath parameters. NOTE: this issue might overlap CVE-2006-6795.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2006-5494?
CVE-2006-5494 is considered a high severity vulnerability due to its ability to allow remote code execution.
How do I fix CVE-2006-5494?
To fix CVE-2006-5494, ensure that you update to a patched version of PHP-Nuke that resolves the file inclusion vulnerabilities.
What versions of PHP-Nuke are affected by CVE-2006-5494?
CVE-2006-5494 affects PHP-Nuke version 8.0, where certain parameters in the pandaBB module are vulnerable.
What are the main exploit vectors for CVE-2006-5494?
The main exploit vectors for CVE-2006-5494 are the adminpath and basepath parameters in the displayCategory.php file.
Can CVE-2006-5494 lead to full system compromise?
Yes, successful exploitation of CVE-2006-5494 can lead to full system compromise by allowing attackers to execute arbitrary PHP code.