CVE-2006-6225 - CVE House
Back to Database
Status published Medium CVE-2006-6225

Multiple PHP remote file inclusion vulnerabilities in GeekLog 1.4 allow...

Vulnerability Description

Multiple PHP remote file inclusion vulnerabilities in GeekLog 1.4 allow remote attackers to execute arbitrary code via a URL in the _CONF[path] parameter to (1) links/functions.inc, (2) polls/functions.inc, (3) spamx/BlackList.Examine.class.php, (4) spamx/DeleteComment.Action.class.php, (5) spamx/EditIPofURL.Admin.class.php, (6) spamx/MTBlackList.Examine.class.php, (7) spamx/MassDelete.Admin.class.php, (8) spamx/MailAdmin.Action.class.php, (9) spamx/MassDelTrackback.Admin.class.php, (10) spamx/EditHeader.Admin.class.php, (11) spamx/EditIP.Admin.class.php, (12) spamx/IPofUrl.Examine.class.php, (13) spamx/Import.Admin.class.php, (14) spamx/LogView.Admin.class.php, and (15) staticpages/functions.inc, in the plugins/ directory.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2006-6225

Credits & Attribution

No credits recorded in the NVD database.

References

More from geeklog

View All →
CVE-2013-1470
Cross-site scripting (XSS) vulnerability in calendar/index.php in the Calendar plugin...
Medium 4.3
CVE-2011-5159
Cross-site scripting (XSS) vulnerability in admin/configuration.php in Geeklog before 1.7.1sr1...
Medium 4.3
CVE-2011-4942
Multiple cross-site scripting (XSS) vulnerabilities in admin/configuration.php in Geeklog before...
Medium 4.3
CVE-2011-4647
Multiple cross-site scripting (XSS) vulnerabilities in the story creation feature...
Medium 4.3
CVE-2010-4933
SQL injection vulnerability in filemgmt/singlefile.php in Geeklog 1.3.8 allows remote...
High 7.5

Affected Vendor

Affected Software

geeklog
Vulnerable Versions:
1.4.0, 1.4.0_beta1, 1.4.0_sr1, 1.4.0_sr2, 1.4.0_sr3, 1.4.0_sr4

Timeline

Official Publish: December 2nd, 2006
Last Modified: August 7th, 2024
Added to House: July 18th, 2026

CVSS Vectors

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.