CVE-2006-1767 - CVE House
Back to Database
Status published High CVE-2006-1767

Multiple PHP remote file inclusion vulnerabilities in nicecoder.com INDEXU 5.0.0...

Vulnerability Description

Multiple PHP remote file inclusion vulnerabilities in nicecoder.com INDEXU 5.0.0 and 5.0.1 allow remote attackers to execute arbitrary PHP code via a URL in the theme_path parameter in (1) index.php, (2) become_editor.php, (3) add.php, (4) bad_link.php, (5) browse.php, (6) detail.php, (7) fav.php, (8) get_rated.php, (9) login.php, (10) mailing_list.php, (11) new.php, (12) modify.php, (13) pick.php, (14) power_search.php, (15) rating.php, (16) register.php, (17) review.php, (18) rss.php, (19) search.php, (20) send_pwd.php, (21) sendmail.php, (22) tell_friend.php, (23) top_rated.php, (24) user_detail.php, and (25) user_search.php; and the (26) base_path parameter in invoice.php.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2006-1767

Credits & Attribution

No credits recorded in the NVD database.

References

More from nicecoder

View All →
CVE-2009-4624
SQL injection vulnerability in download.php in Nicecoder iDesk allows remote...
High 7.5
CVE-2007-0364
Multiple cross-site scripting (XSS) vulnerabilities in nicecoder.com INDEXU 5.3 and...
Medium 4.3
CVE-2007-0349
Directory traversal vulnerability in upgrade.php in nicecoder.com INDEXU 5.x allows...
Medium 5
CVE-2006-7017
Multiple PHP remote file inclusion vulnerabilities in Indexu 5.0.1 allow...
High 7.5
CVE-2006-0688
PHP remote file include vulnerability in application.php in nicecoder.com indexu...
High 7.5

Affected Vendor

Affected Software

indexu
Vulnerable Versions:
5.0, 5.0.1

Timeline

Official Publish: April 13th, 2006
Last Modified: August 7th, 2024
Added to House: July 18th, 2026

CVSS Vectors

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.