{"id":"CVE-2006-4677","published":"2006-09-11T17:00:00Z","modified":"2024-08-07T19:23:40Z","title":"PHP remote file inclusion vulnerability in contrib/yabbse/poc.php in phpopenchat before 3.0.2 allows remote attackers…","vendor":null,"product":null,"tier":"tail","description":{"text":"PHP remote file inclusion vulnerability in contrib/yabbse/poc.php in phpopenchat before 3.0.2 allows remote attackers to execute arbitrary PHP code via the sourcedir parameter.  NOTE: this issue was disputed by a third-party researcher who stated that the _REQUEST parameters were dynamically unset at the beginning of the file.  Another researcher noted, and CVE agrees, that the unset PHP function can be bypassed (CVE-2006-3017).  If this issue is due to a vulnerability in PHP, then it should be excluded from CVE","provenance":"source","from":"CVE.org"},"cvss":null,"epss":{"score":0.01583,"percentile":0.75467,"provenance":"source"},"cwes":[],"references":[{"url":"http://www.securityfocus.com/archive/1/445580/100/0/threaded","tags":["mailing-list","x_refsource_BUGTRAQ"]},{"url":"http://phpopenchat.org/index.php","tags":["x_refsource_CONFIRM"]},{"url":"http://www.securityfocus.com/archive/1/445522/100/0/threaded","tags":["mailing-list","x_refsource_BUGTRAQ"]},{"url":"http://www.securityfocus.com/archive/1/445384/100/0/threaded","tags":["mailing-list","x_refsource_BUGTRAQ"]}],"priority":{"score":15.1,"factors":[{"name":"EPSS percentile","points":15.09}]},"euvd":{"id":"EUVD-2006-4665","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-cve-2006-3017-family-cve-2006-3017","parents":[{"from":"CVE-2006-3017","to":"CVE-2006-4677","relation":"bypass","confidence":"high","kind":"lineage","evidence":[{"kind":"text","provenance":"source","relation":"bypass","quote":"Another researcher noted, and CVE agrees, that the unset PHP function can be bypassed (CVE-2006-3017).","from":"CVE.org","in":"CVE-2006-4677"}]}]}}