CVE-2006-4559

Remote attackers can execute arbitrary PHP code by providing a crafted URL in the context[path_to_root] parameter. This parameter is used in multiple PHP files within the application. By controlling this parameter, an attacker can trick the application into including and executing malicious code from a remote server. The exploit example shows a URL pointing to a remote shell script [ref_id=1].

The vulnerability exists in multiple PHP files including articles/populate.php, categories/category.php, categories/populate.php, comments/populate.php, files/file.php, sections/section.php, sections/populate.php, tables/populate.php, users/user.php, and users/populate.php. The context[path_to_root] parameter in these files is susceptible to remote file inclusion [ref_id=1].

The advisory does not specify a patch or provide details on how the vulnerability is fixed. Remediation guidance typically involves updating to a patched version or applying security configurations to prevent the inclusion of external files. Users are advised to consult vendor advisories for specific mitigation steps.