Harpia · Harpia Cms · CVE-2006-7024
**Name of the Vulnerable Software and Affected Versions**
Harpia CMS versions 1.0.5 and earlier
**Description**
The issue allows remote attackers to execute arbitrary PHP code via specific parameters in various PHP files. This can be achieved by manipulating the following parameters:
- `func prog` parameter in `preload.php` and `index.php`
- `header prog` parameter in multiple files including `missing.php`, `email.php`, `files.php`, `headlines.php`, `search.php`, `topics.php`, and `users.php` in the ` mods/` directory
- `theme root` parameter in `footer.php`, `header.php`, `pfooter.php`, and `pheader.php` in the ` inc` directory
- `mod root` parameter in ` inc/header.php`
- `mod dir` and `php ext` parameters in ` inc/web statsConfig.php`
**Recommendations**
For Harpia CMS versions 1.0.5 and earlier, consider disabling the `func prog`, `header prog`, `theme root`, `mod root`, `mod dir`, and `php ext` parameters in the respective files until a patch is available. Restrict access to the vulnerable PHP files in the ` mods/` and ` inc` directories to minimize the risk of exploitation. Avoid using these parameters in the affected API endpoints until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.