RCE in Objective Development Webyep
CVE-2006-5220
Multiple PHP remote file inclusion vulnerabilities in WebYep 1.1.9, when register_globals is enabled, allow remote attackers to execute arbitrary PHP code via the webyep_sIncludePath in (1) files in the programm/lib/ directory including (a) WYApplication.php, (b) WYDocument.php, (c) WYEditor.php, (d) WYElement.php, (e) WYFile.php, (f) WYHTMLTag.php, (g) WYImage.php, (h) WYLanguage.php, (i) WYLink.php, (j) WYPath.php, (k) WYPopupWindowLink.php, (l) WYSelectMenu.php, and (m) WYTextArea.php; (2) files in the programm/elements/ directory including (n) WYGalleryElement.php, (o) WYGuestbookElement.php, (p) WYImageElement.php, (q) WYLogonButtonElement.php, (r) WYLongTextElement.php, (s) WYLoopElement.php, (t) WYMenuElement.php, and (u) WYShortTextElement.php; and (3) programm/webyep.php.
Vulnerability class: RCE (Remote Code Execution)
Published · last modified .
CVSS v2 metric
CVSS v2 base score 5.1 (Medium). Vector: AV:N/AC:H/Au:N/C:P/I:P/A:P. This CVE predates CVSS v3 and has no v3 score from NVD.
EPSS exploit prediction
EPSS: 0.146 (96.5th percentile), scored .
Moderate probability of exploitation in the next 30 days — watch for active exploitation reports. 97th percentile — 96.5% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.090 · newest: 0.146 · change: +0.056
Affected products
- Objective Development Webyep — versions 1.1.9
Weakness classification (CWE)
References
- securityreason.com/securityalert/1702 (third-party-advisory)
- www.exploit-db.com/exploits/2496 (exploit)
- www.osvdb.org/29654 (vdb-entry)
- www.osvdb.org/29648 (vdb-entry)
- www.osvdb.org/29660 (vdb-entry)
- advisories.echo.or.id/adv/adv48-theday-2006.txt (Vendor Advisory)
- www.osvdb.org/29645 (vdb-entry)
- www.securityfocus.com/bid/20406 (Exploit, vdb-entry)
- www.osvdb.org/29644 (vdb-entry)
- www.securityfocus.com/archive/1/448009/100/0/threaded (mailing-list)