ERNE

13 exploits Active since Jun 2006
CVE-2006-4764 EXPLOITDB text WRITEUP
Thomas LETE WTools <0.0.1-ALPH - RCE
PHP remote file inclusion vulnerability in common.php in Thomas LETE WTools 0.0.1-ALPH allows remote attackers to execute arbitrary PHP code via a URL in the include_path parameter.
CVE-2006-4666 EXPLOITDB text WRITEUP
Stefan Ernst Newsscript 0.5 beta - RCE
Multiple PHP remote file inclusion vulnerabilities in Stefan Ernst Newsscript (aka WM-News) 0.5 beta allow remote attackers to execute arbitrary PHP code via a URL in the (1) ide parameter in (a) article.php; or the (2) pwfile parameter in (b) delete.php, (c) modify.php, (d) admin.php, or (e) modify_go.php.
CVE-2006-3053 EXPLOITDB text WRITEUP
Phorum < 5.1.13 - Remote File Inclusion via PHORUM[http_path] Parameter
PHP remote file inclusion vulnerability in common.php in PHORUM 5.1.13 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the PHORUM[http_path] parameter. NOTE: this issue has been disputed by the vendor, who states "common.php is checked on the very first line of non-comment code that it is not being called directly. It has been this way in all 5.x version of Phorum." CVE analysis concurs with the vendor
EIP-2026-110865 EXPLOITDB text WRITEUP
PHP-Nuke 7.x - Multiple Remote File Inclusions
CVE-2006-2828 EXPLOITDB text WRITEUP
PHP-Nuke - Remote PHP File Inclusion via phpbb_root_path Parameter Overwrite
Global variable overwrite vulnerability in PHP-Nuke allows remote attackers to conduct remote PHP file inclusion attacks via a modified phpbb_root_path parameter to the admin scripts (1) index.php, (2) admin_ug_auth.php, (3) admin_board.php, (4) admin_disallow.php, (5) admin_forumauth.php, (6) admin_groups.php, (7) admin_ranks.php, (8) admin_styles.php, (9) admin_user_ban.php, (10) admin_words.php, (11) admin_avatar.php, (12) admin_db_utilities.php, (13) admin_forum_prune.php, (14) admin_forums.php, (15) admin_mass_email.php, (16) admin_smilies.php, (17) admin_ug_auth.php, and (18) admin_users.php, which overwrites $phpbb_root_path when the import_request_variables function is executed after $phpbb_root_path has been initialized to a static value.
CVE-2006-4719 EXPLOITDB text WRITEUP
MyABraCaDaWeb 1.0.3 - Remote File Inclusion via Base Parameter
Multiple PHP remote file inclusion vulnerabilities in MyABraCaDaWeb 1.0.3, when register_globals is enabled, allow remote attackers to execute arbitrary PHP code via a URL in the base parameter to (1) index.php or (2) pop.php.
CVE-2006-4678 EXPLOITDB text WRITEUP
News Evolution 3.0.3 - Remote File Inclusion via _NE[AbsPath] Parameter
PHP remote file inclusion vulnerability in News Evolution 3.0.3 allows remote attackers to execute arbitrary PHP code via the _NE[AbsPath] parameter in (1) install.php and (2) migrateNE2toNE3.php.
CVE-2006-7120 EXPLOITDB text WORKING POC
maintain 3.0.0-RC2 - Remote File Inclusion via phphtmllib Parameter
PHP remote file inclusion vulnerability in lib/php/phphtmllib-2.5.4/examples/example6.php for maintain 3.0.0-RC2 allows remote attackers to execute arbitrary PHP code via a URL in the phphtmllib parameter. NOTE: this issue might be in phpHtmlLib. NOTE: CVE disputes this issue for proper installations of maintain, since $phphtmllib is set in includes.inc before being used in example6.php
CVE-2006-7131 EXPLOITDB text WRITEUP
Jinzora 2.6 - Remote Code Execution
PHP remote file inclusion vulnerability in extras/mt.php in Jinzora 2.6 allows remote attackers to execute arbitrary PHP code via the web_root parameter.
CVE-2006-4848 EXPLOITDB text WRITEUP
Hitweb 3.0 - Remote File Inclusion via REP_CLASS Parameter
Multiple PHP remote file inclusion vulnerabilities in Brian Fraval Hitweb 3.0 allow remote attackers to execute arbitrary PHP code via a URL in the REP_CLASS parameter to (1) index.php, (2) arbo.php, (3) framepoint.php, (4) genpage.php, (5) lienvalider.php, (6) appreciation.php, (7) partenariat.php, (8) rechercher.php, (9) projet.php, (10) propoexample.php, (11) refererpoint.php, or (12) top50.php. NOTE: this issue has been disputed by a third party researcher, stating that REP_CLASS is initialized in an included file before being used
CVE-2006-4716 EXPLOITDB text WRITEUP
Fire Soft Board < rc3 - Remote File Inclusion via racine Parameter
PHP remote file inclusion vulnerability in demarrage.php in Fire Soft Board (FSB) RC3 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the racine parameter.
CVE-2006-4645 EXPLOITDB text WRITEUP
Akarru Social BookMarking Engine <0.4.4.120 - RCE
PHP remote file inclusion vulnerability in akarru.gui/main_content.php in Akarru Social BookMarking Engine 0.4.3.34 and earlier, and possibly 0.4.4.120, allows remote attackers to execute arbitrary PHP code via a URL in the bm_content parameter.
CVE-2006-4637 EXPLOITDB text WRITEUP
ACGV News 0.9.1 - Remote Code Execution via PathNews Parameter
Multiple PHP remote file inclusion vulnerabilities in ACGV News 0.9.1 allow remote attackers to execute arbitrary PHP code via a URL in the PathNews parameter in (1) header.php or (2) news.php. NOTE: portions of these details are obtained from third party information.