CVE-2006-3850

· N/AModified

← All CVEs

CVSS v3.1

N/A

EPSS

3.38%

Published

Jul 25, 2006

Modified

Jun 16, 2026

Public PoC / Exploit (1)

All weaponized →

Exploit-DBLussumo Vanilla 1.0 - RootDirectory Remote File Inclusion

Links to public security research (Exploit-DB, Nuclei, Trickest, GitHub) for defensive use only.

Description

PHP remote file inclusion vulnerability in upgrader.php in Vanilla CMS 1.0.1 and earlier, when /conf/old_settings.php exists, allows remote attackers to execute arbitrary PHP code via a URL in the RootDirectory parameter. NOTE: this issue has been disputed by a third party who states that the RootDirectory parameter is initialized before being used, for version 1.0. CVE analysis concurs with the dispute, but it is unclear whether older versions are affected

Affected Products (1)

lussumo · vanillavulnerable

References (16)

http://securityreason.com/securityalert/1281

http://securitytracker.com/id?1016568

http://www.attrition.org/pipermail/vim/2006-July/000937.html

http://www.attrition.org/pipermail/vim/2006-July/000944.html

http://www.osvdb.org/28287

http://www.securityfocus.com/archive/1/440938/100/0/threaded

http://www.securityfocus.com/archive/1/442450/100/0/threaded

http://www.securityfocus.com/bid/19127

Exploit