A vulnerability was found in Timm Maass Alice Cms 0.1 (Content Management System). It has been rated as critical. This issue affects some unknown processing. The manipulation of the argument CONFIG[local_root] with an unknown input leads to a file inclusion vulnerability. Using CWE to declare the problem leads to CWE-73. The product allows user input to control or influence paths or file names that are used in filesystem operations. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

PHP remote file inclusion vulnerability in modules/guestbook/index.php in ALiCE-CMS 0.1 allows remote attackers to execute arbitrary PHP code via a URL in the CONFIG[local_root] parameter.

The weakness was published 10/20/2006 by nuffsaid (Website). The advisory is shared at milw0rm.com. The identification of this vulnerability is CVE-2006-5433 since 10/20/2006. The exploitation is known to be easy. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. Technical details as well as a public exploit are known.

The exploit is available at exploit-db.com. It is declared as proof-of-concept.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The vulnerability is also documented in the databases at X-Force (29633), Exploit-DB (2582) and SecurityFocus (BID 20585†).

Productinfo

Type

• Content Management System

Vendor

• Timm Maass

Name

• Alice Cms

Version

• 0.1

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Discussion