NVD Vulnerability Detail

CVE-2006-4189

Summary	Multiple PHP remote file inclusion vulnerabilities in Dolphin 5.1 allow remote attackers to execute arbitrary PHP code via a URL in the dir[inc] parameter in (1) index.php, (2) aemodule.php, (3) browse.php, (4) cc.php, (5) click.php, (6) faq.php, (7) gallery.php, (8) im.php, (9) inbox.php, (10) join_form.php, (11) logout.php, (12) messages_inbox.php, and many other scripts.
Publication Date	Aug. 17, 2006, 10:04 a.m.
Registration Date	Jan. 29, 2021, 3:43 p.m.
Last Update	July 20, 2017, 10:32 a.m.

CVSS2.0 : MEDIUM
Score	5.1
Vector	AV:N/AC:H/Au:N/C:P/I:P/A:P
攻撃元区分(AV)	ネットワーク
攻撃条件の複雑さ(AC)	高
攻撃前の認証要否(Au)	不要
機密性への影響(C)	低
完全性への影響(I)	低
可用性への影響(A)	低
Get all privileges.	いいえ
Get user privileges	いいえ
Get other privileges	はい
User operation required	いいえ

Affected software configurations

Configuration1		or higher	or less	more than	less than
cpe:2.3:a:boonex:dolphin:5.1:::::::*

Related information, measures and tools

No	URL	refsource	タグ
1	http://secunia.com/advisories/21535	SECUNIA	Vendor Advisory
2	http://securitytracker.com/id?1016692	SECTRACK	Exploit
3	http://www.osvdb.org/28473	OSVDB	Exploit
4	http://www.osvdb.org/28474	OSVDB	Exploit
5	http://www.osvdb.org/28478	OSVDB	Exploit
6	http://www.osvdb.org/28479	OSVDB	Exploit
7	http://www.osvdb.org/28485	OSVDB	Exploit
8	http://www.osvdb.org/28492	OSVDB	Exploit
9	http://www.osvdb.org/28493	OSVDB	Exploit
10	http://www.osvdb.org/28496	OSVDB	Exploit
11	http://www.osvdb.org/28498	OSVDB	Exploit
12	http://www.osvdb.org/28499	OSVDB	Exploit
13	http://www.osvdb.org/28500	OSVDB	Exploit
14	http://www.osvdb.org/28501	OSVDB	Exploit
15	http://www.osvdb.org/28502	OSVDB	Exploit
16	http://www.osvdb.org/28503	OSVDB	Exploit
17	http://www.osvdb.org/28504	OSVDB	Exploit
18	http://www.osvdb.org/28505	OSVDB	Exploit
19	http://www.osvdb.org/28506	OSVDB	Exploit
20	http://www.osvdb.org/28507	OSVDB	Exploit
21	http://www.osvdb.org/28508	OSVDB	Exploit
22	http://www.osvdb.org/28509	OSVDB	Exploit
23	http://www.osvdb.org/28510	OSVDB	Exploit
24	http://www.osvdb.org/28511	OSVDB	Exploit
25	http://www.osvdb.org/28512	OSVDB	Exploit
26	http://www.osvdb.org/28513	OSVDB	Exploit
27	http://www.osvdb.org/28514	OSVDB	Exploit
28	http://www.osvdb.org/28515	OSVDB	Exploit
29	http://www.osvdb.org/28516	OSVDB	Exploit
30	http://www.osvdb.org/28517	OSVDB	Exploit
31	http://www.osvdb.org/28519	OSVDB	Exploit
32	http://www.osvdb.org/28520	OSVDB	Exploit
33	http://www.osvdb.org/28521	OSVDB	Exploit
34	http://www.osvdb.org/28522	OSVDB	Exploit
35	http://www.osvdb.org/28523	OSVDB	Exploit
36	http://www.osvdb.org/28524	OSVDB	Exploit
37	http://www.osvdb.org/28525	OSVDB	Exploit
38	http://www.osvdb.org/28526	OSVDB	Exploit
39	http://www.osvdb.org/28527	OSVDB	Exploit
40	http://www.osvdb.org/28528	OSVDB	Exploit
41	http://www.osvdb.org/28529	OSVDB	Exploit
42	http://www.osvdb.org/28530	OSVDB	Exploit
43	http://www.securityfocus.com/bid/21182	BID
44	http://www.vupen.com/english/advisories/2006/3346	VUPEN
45	https://exchange.xforce.ibmcloud.com/vulnerabilities/28363	XF

Common Vulnerabilities List

JVN Vulnerability Information

Dolphin における PHP リモートファイルインクルージョンの脆弱性

Title	Dolphin における PHP リモートファイルインクルージョンの脆弱性
Summary	Dolphin には、PHP リモートファイルインクルージョンの脆弱性が存在します。
Possible impacts	第三者により、以下のスクリプトの dir[inc] パラメータの URL を介して、任意の PHP コードが実行される可能性があります。 (1) index.php (2) aemodule.php (3) browse.php (4) cc.php (5) click.php (6) faq.php (7) gallery.php (8) im.php (9) inbox.php (10) join_form.php (11) logout.php (12) messages_inbox.php など
Solution	ベンダ情報および参考情報を参照して適切な対策を実施してください。
Publication Date	Aug. 16, 2006, midnight
Registration Date	June 26, 2012, 3:37 p.m.
Last Update	June 26, 2012, 3:37 p.m.

Affected System

BoonEx

Dolphin 5.1

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2006-4189	http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-4189
National Vulnerability Database (NVD)
2	CVE-2006-4189	http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2006-4189

ベンダー情報

No	Name	URL
BoonEx
1	Top Page	http://www.boonex.com/dolphin

Change Log

No	Changed Details	Date of change
0	[2012年06月26日] 掲載	Feb. 17, 2018, 10:37 a.m.