CVE-2006-5480 in PHP Web Builder
Summary
by MITRE
PHP remote file inclusion vulnerability in lib/rs.php in 2le.net Castor PHP Web Builder 1.1.1 allows remote attackers to execute arbitrary PHP code via the rootpath parameter.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 04/25/2026
The vulnerability identified as CVE-2006-5480 represents a critical remote file inclusion flaw within the 2le.net Castor PHP Web Builder version 1.1.1. This issue resides in the lib/rs.php component where the application fails to properly validate user-supplied input before incorporating it into file paths. The vulnerability specifically affects the rootpath parameter which is processed without adequate sanitization, creating an avenue for malicious actors to inject arbitrary file paths and subsequently execute unauthorized PHP code on the target server. Such vulnerabilities fall under the category of CWE-98 - Improper Control of Generation of Code and are classified as remote code execution threats that can be exploited through web-based attacks.
The technical exploitation of this vulnerability occurs when an attacker crafts a malicious request containing a specially formatted rootpath parameter that points to an external malicious PHP script hosted on a remote server. When the web application processes this parameter, it includes and executes the remote file, effectively allowing the attacker to run arbitrary code with the privileges of the web server process. This type of attack directly aligns with ATT&CK technique T1190 - Exploit Public-Facing Application, where adversaries leverage vulnerabilities in publicly accessible web applications to gain unauthorized access and execute malicious commands. The flaw demonstrates poor input validation practices and highlights the importance of proper parameter sanitization in web applications.
The operational impact of this vulnerability is severe as it provides attackers with complete control over the affected web server. Once exploited, malicious actors can upload additional malware, establish persistent backdoors, access sensitive data stored on the server, and potentially use the compromised system as a launch point for further attacks within the network. The vulnerability affects the integrity and confidentiality of the web application and can lead to data breaches, service disruption, and compliance violations. Organizations using the affected Castor PHP Web Builder version 1.1.1 face significant risk of unauthorized access and potential system compromise, particularly in environments where the web application is accessible from the internet.
Mitigation strategies for this vulnerability should focus on immediate patching of the affected application to version 1.1.2 or later, which includes proper input validation and sanitization. Administrators should implement proper parameter validation techniques using allowlists of acceptable values rather than denylists, and employ secure coding practices that prevent dynamic file inclusion with user-controllable parameters. Input sanitization should include filtering of special characters and ensuring that all file paths are validated against a whitelist of known good values. Additionally, network-level protections such as web application firewalls can provide additional layers of defense, while regular security assessments and code reviews can help identify similar vulnerabilities in other applications. Organizations should also consider implementing the principle of least privilege for web server accounts and ensure that file inclusion operations are properly restricted to prevent arbitrary code execution.