Unscored severity · published Nov 10, 2006
CVE-2006-5832
All In One Control Panel (AIOCP) 1.3.007 and earlier allows remote attackers to obtain the full path of the web server via certain requests to (1) public/code/cp_dpage.php,…
–
CVSS
3.1%
EPSS
No
On KEV
Description
All In One Control Panel (AIOCP) 1.3.007 and earlier allows remote attackers to obtain the full path of the web server via certain requests to (1) public/code/cp_dpage.php, possibly involving the aiocp_dp[] parameter, (2) public/code/cp_show_ec_products.php, possibly involving the order_field[] parameter, and (3) public/code/cp_show_page_help.php, possibly involving the hp[] parameter, which reveal the path in various error messages.
Exploitation
Is it being used?
Exploit prediction (EPSS)3.1% · higher than 88% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AI
Aiocp · Aiocp
1.3.000; 1.3.001; 1.3.002; 1.3.003; 1.3.004; 1.3.005; +2 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2006-5832
CVE.org
https://www.cve.org/CVERecord?id=CVE-2006-5832
securityreason.com
http://securityreason.com/securityalert/1839
sourceforge.net
http://sourceforge.net/project/shownotes.php?release_id=478370
www.securityfocus.com
http://www.securityfocus.com/archive/1/450701/100/0/threaded
Exploit
http://www.securityfocus.com/bid/20931
exchange.xforce.ibmcloud.com
https://exchange.xforce.ibmcloud.com/vulnerabilities/30052
More from Aiocp
–
CVE-2008-4782
SQL injection vulnerability in public/code/cp_polls_results.php in All In One Control Panel (AIOCP) 1.4 allows remote attackers to execute arbitrary SQL commands via the poll_id…
–
CVE-2007-3120
Cross-site scripting (XSS) vulnerability in public/code/cp_dpage.php in All In One Control Panel (AIOCP) before 1.3.017 allows remote attackers to inject arbitrary web script or…
–
CVE-2007-2624
Dynamic variable evaluation vulnerability in shared/config/cp_config.php in All In One Control Panel (AIOCP) before 1.3.016 allows remote attackers to conduct cross-site scripting…
–
CVE-2007-2625
Cross-site scripting (XSS) vulnerability in shared/code/cp_authorization.php in All In One Control Panel (AIOCP) before 1.3.016 allows remote attackers to inject arbitrary web…
–
CVE-2006-5829
Multiple SQL injection vulnerabilities in All In One Control Panel (AIOCP) 1.3.007 and earlier allow remote attackers to execute arbitrary SQL commands via the (1)…