CVE-2006-3421

SmartSiteCMS <1.0 - RCE

Title source: llm

Description

PHP remote file inclusion vulnerability in SmartSiteCMS 1.0 and earlier, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via the root parameter in (1) comment.php, (2) admin/comedit.php, (3) admin/test.php, (4) admin/index.php, and (5) admin/include/inc_adminfoot.php, a different set of vectors than CVE-2006-3162.

Exploits (2)

exploitdb WORKING POC VERIFIED

by CrAsh_oVeR_rIdE · textwebappsphp

https://www.exploit-db.com/exploits/1974

View Code ZIP pw:eip

exploitdb WORKING POC VERIFIED

by Archit3ct · textwebappsphp

https://www.exploit-db.com/exploits/1936

View Code ZIP pw:eip

References (9)

Core 9

Core References

Exploit vdb-entry x_refsource_osvdb

http://www.osvdb.org/26748

Third Party Advisory, VDB Entry vdb-entry x_refsource_sectrack

http://securitytracker.com/id?1016411

Third Party Advisory, VDB Entry vdb-entry x_refsource_bid

http://www.securityfocus.com/bid/18697

Third Party Advisory, VDB Entry vdb-entry x_refsource_osvdb

http://www.osvdb.org/26752

Exploit vdb-entry x_refsource_osvdb

http://www.osvdb.org/26750

Exploit vdb-entry x_refsource_osvdb

http://www.osvdb.org/26749

Third Party Advisory, VDB Entry mailing-list x_refsource_bugtraq

http://www.securityfocus.com/archive/1/438581/100/100/threaded

Third Party Advisory third-party-advisory x_refsource_sreason

http://securityreason.com/securityalert/1198

Exploit vdb-entry x_refsource_osvdb

http://www.osvdb.org/26751

Scores

EPSS 0.0754

EPSS Percentile 91.8%

Details

Status published

Products (1)

smartsitecms/smartsitecms < 1.0

Published Jul 07, 2006

Tracked Since Feb 18, 2026