Description
PHP remote file inclusion vulnerability in sipssys/code/box.inc.php in Haakon Nilsen simple, integrated publishing system (SIPS) 0.3.1 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the config[sipssys] parameter. NOTE: the product's documentation recommends placing the affected file outside of the web root, so the scope of issue is limited to admins who do not, or cannot, follow this recommendation.
Exploits (1)
References (6)
Core 6
Core References
Product x_refsource_misc
http://sips.cvs.sourceforge.net/sips/sips/sipssys/code/box.inc.php?revision=1.9&view=markup
Third Party Advisory third-party-advisory
x_refsource_sreason
http://securityreason.com/securityalert/1549
Third Party Advisory mailing-list
x_refsource_vim
http://www.attrition.org/pipermail/vim/2007-February/001268.html
Exploit, Third Party Advisory exploit
x_refsource_exploit-db
https://www.exploit-db.com/exploits/3245
Third Party Advisory, VDB Entry mailing-list
x_refsource_bugtraq
http://www.securityfocus.com/archive/1/445770/100/0/threaded
Exploit vdb-entry
x_refsource_bid
http://www.securityfocus.com/bid/19945
Scores
EPSS
0.1146
EPSS Percentile
93.6%
Details
Status
published
Products (6)
sips/sips
0.2.2
sips/sips
0.2.4
sips/sips
0.3.0
sips/sips
0.3.0pl1
sips/sips
0.3.0pl2
sips/sips
< 0.3.1
Published
Sep 13, 2006
Tracked Since
Feb 18, 2026