PT-2007-1461 · Exhibit Engine · Exhibit Engine

Kacper · Published 2007-03-30 · Updated 2017-10-11 · CVE-2006-7183

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Exhibit Engine (EE) versions 1.22 and earlier

Description The issue allows remote attackers to execute arbitrary PHP code via a URL in the toroot parameter. This is a result of a PHP remote file inclusion vulnerability in the styles.php file.

Recommendations For Exhibit Engine (EE) versions 1.22 and earlier, consider updating to a version later than 1.22 to resolve the issue. As a temporary workaround, restrict access to the styles.php file to minimize the risk of exploitation. Avoid using the toroot parameter in the affected URL until the issue is resolved.

Exploit

Fix

Related Identifiers

CVE-2006-7183

Affected Products

Exhibit Engine

References · 4

• 🔥 https://exploit-db.com/exploits/2850 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2006-7183 · Security Note
• http://securityfocus.com/bid/21313 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/30516 · Note