CVE-2006-0755
MEDIUMdotProject <= 2.0.1 - Remote File Inclusion via baseDir and dPconfig Parameters
Title source: llmExploitation Summary
EIP tracks 10 public exploits for CVE-2006-0755. PoCs published by dun, r.verton.
AI-analyzed exploit summary This is a writeup describing a Remote File Inclusion (RFI) vulnerability in dotProject <= 2.1.6. The vulnerability exists in the `gantt.php` file due to improper handling of the `dPconfig[root_dir]` parameter, allowing remote file inclusion when `allow_url_include` and `register_globals` are enabled.
Description
Multiple PHP remote file include vulnerabilities in dotProject 2.0.1 and earlier, when register_globals is enabled, allow remote attackers to execute arbitrary commands via the baseDir parameter in (1) db_adodb.php, (2) db_connect.php, (3) session.php, (4) vw_usr_roles.php, (5) calendar.php, (6) date_format.php, and (7) tasks/gantt.php; and the dPconfig[root_dir] parameter in (8) projects/gantt.php, (9) gantt2.php, and (10) vw_files.php. NOTE: the vendor disputes this issue, stating that the product documentation clearly recommends that the system administrator disable register_globals, and that the check.php script warns against this setting. Also, the vendor says that the protection.php/siteurl vector is incorrect because protection.php does not exist in the product
Exploits (10)
This is a writeup describing a Remote File Inclusion (RFI) vulnerability in dotProject <= 2.1.6. The vulnerability exists in the `gantt.php` file due to improper handling of the `dPconfig[root_dir]` parameter, allowing remote file inclusion when `allow_url_include` and `register_globals` are enabled.
The provided text describes a remote file inclusion vulnerability in Dotproject, where unsanitized user input in the 'baseDir' parameter of 'gantt.php' allows arbitrary remote file inclusion. This can lead to remote code execution in the context of the webserver process.
The provided text describes a remote file inclusion vulnerability in Dotproject, where unsanitized user input in the 'baseDir' parameter allows arbitrary remote file inclusion. This can lead to remote code execution in the context of the webserver process.
The provided text describes a remote file inclusion vulnerability in Dotproject, where unsanitized user input in the 'baseDir' parameter of calendar.php allows arbitrary remote file inclusion. This can lead to remote code execution in the context of the webserver process.
The code describes a remote file inclusion vulnerability in Dotproject due to improper input sanitization. An attacker can exploit this to execute arbitrary PHP code by including a remote file via the 'dPconfig[root_dir]' parameter.
The provided text describes a remote file inclusion vulnerability in Dotproject, where unsanitized user input in the 'dPconfig[root_dir]' parameter allows arbitrary remote file inclusion. This can lead to remote code execution in the context of the webserver process.
The provided text describes a remote file inclusion vulnerability in Dotproject, where unsanitized user input in the 'dPconfig[root_dir]' parameter allows arbitrary remote file inclusion. No actual exploit code is present, only a description and example URL.
The provided text describes a remote file inclusion vulnerability in Dotproject, where unsanitized user input allows an attacker to include arbitrary remote files containing malicious PHP code. The example URL demonstrates the vulnerable parameter 'baseDir' in the 'vw_usr_roles.php' module.
The provided text describes a remote file inclusion vulnerability in Dotproject, where unsanitized user input in the 'baseDir' parameter of 'session.php' allows arbitrary remote file inclusion. This can lead to remote code execution in the context of the webserver process.
The provided text describes a remote file inclusion vulnerability in Dotproject, where unsanitized user input in the 'baseDir' parameter allows arbitrary remote file inclusion. No actual exploit code is present, only a description and example URL.
References (17)
Scores
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L