CVE-2006-4889 in SignKorn Guestbook

摘要

由 VulDB • 2026-07-06

Telekorn SignKorn Guestbook (SL) 1.3及更早版本中存在多个PHP远程文件包含漏洞，当启用register_globals时，攻击者可以通过在(1)index.php、(2)includes/functions.gb.php、(3)includes/functions.admin.php、(4)includes/admin.inc.php、(5)help.php、(6)smile.php、(7)entry.php；以及(a)help/en和(b)help/de目录中的(8)adminhelp0.php、(9)adminhelp1.php、(10)adminhelp2.php和(11)adminhelp3.php，还有(c)admin目录下的(12)preview.php、(13)log.php、(14)index.php、(15)config.php和(16)admin.php中的dir_path参数传入URL来执行任意PHP代码。这些攻击向量与CVE-2006-4788不同。

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

• 预定: 2006-09-19
• 披露: 2006-09-19
• 管理: 已接受
• 条目: VDB-32376
• CPE: 准备好
• CWE: CWE-73 (已确认)
• CVSS: 5.6 (VulDB)
• EPSS: 0.10168
• KEV: 否
• 活动: 非常低

来源

• MITRE: https://www.cve.org/CVERecord?id=CVE-2006-4889
• NVD: https://nvd.nist.gov/vuln/detail/CVE-2006-4889
• CVE Details: https://www.cvedetails.com/cve/CVE-2006-4889/