CVE-2006-4215 - PHP remote file inclusion vulnerability in index.php in Zen Cart 1.3.0.2 and earlier, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the autoLoadConfig[999][0][loadFile] parameter

Back Back to CVE browser

MEDIUM

PHP remote file inclusion vulnerability in index.php in Zen Cart 1.3.0.2 and earlier, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the autoLoadConfig[999][0][loadFile] parameter

Published Aug 17, 2006

5.1

MEDIUM

CVSS 2.0

EPSS 2.90%

Description

PHP remote file inclusion vulnerability in index.php in Zen Cart 1.3.0.2 and earlier, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the autoLoadConfig[999][0][loadFile] parameter.

Affected products

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-94

Code Injection

References (7)

http://secunia.com/advisories/21484
third-party-advisoryx_refsource_SECUNIAVendor Advisory
http://www.gulftech.org/?node=research&article_id=00109-08152006
x_refsource_MISC
http://www.osvdb.org/28149
vdb-entryx_refsource_OSVDB
http://www.securityfocus.com/bid/19543
vdb-entryx_refsource_BID
http://www.vupen.com/english/advisories/2006/3283
vdb-entryx_refsource_VUPENVendor Advisory
https://euvd.enisa.europa.eu/vulnerability/EUVD-2006-4205
Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/28394
vdb-entryx_refsource_XF

Link	Providers	Tags
http://secunia.com/advisories/21484		third-party-advisoryx_refsource_SECUNIAVendor Advisory
http://www.gulftech.org/?node=research&article_id=00109-08152006		x_refsource_MISC
http://www.osvdb.org/28149		vdb-entryx_refsource_OSVDB
http://www.securityfocus.com/bid/19543		vdb-entryx_refsource_BID
http://www.vupen.com/english/advisories/2006/3283		vdb-entryx_refsource_VUPENVendor Advisory
https://euvd.enisa.europa.eu/vulnerability/EUVD-2006-4205		Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/28394		vdb-entryx_refsource_XF