CVE-2006-5832

AIOCP <1.3.007 - Info Disclosure

Title source: llm
STIX 2.1

Description

All In One Control Panel (AIOCP) 1.3.007 and earlier allows remote attackers to obtain the full path of the web server via certain requests to (1) public/code/cp_dpage.php, possibly involving the aiocp_dp[] parameter, (2) public/code/cp_show_ec_products.php, possibly involving the order_field[] parameter, and (3) public/code/cp_show_page_help.php, possibly involving the hp[] parameter, which reveal the path in various error messages.

Exploits (3)

exploitdb WORKING POC VERIFIED
by laurent gaffie · textwebappsphp
https://www.exploit-db.com/exploits/28935
exploitdb WRITEUP VERIFIED
by laurent gaffie · textwebappsphp
https://www.exploit-db.com/exploits/28937
exploitdb WRITEUP VERIFIED
by laurent gaffie · textwebappsphp
https://www.exploit-db.com/exploits/28936

References (5)

Core 5
Core References
Third Party Advisory, VDB Entry vdb-entry x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/30052
Third Party Advisory, VDB Entry mailing-list x_refsource_bugtraq
http://www.securityfocus.com/archive/1/450701/100/0/threaded
Third Party Advisory third-party-advisory x_refsource_sreason
http://securityreason.com/securityalert/1839
Exploit vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/20931

Scores

EPSS 0.0609
EPSS Percentile 90.8%

Details

Status published
Products (8)
aiocp/aiocp 1.3.000
aiocp/aiocp 1.3.001
aiocp/aiocp 1.3.002
aiocp/aiocp 1.3.003
aiocp/aiocp 1.3.004
aiocp/aiocp 1.3.005
aiocp/aiocp 1.3.006
aiocp/aiocp 1.3.007
Published Nov 10, 2006
Tracked Since Feb 18, 2026