CVE-2006-2686

MEDIUM 6.4CVE-2006-2686 · Published 31/05/2006 · updated 16/06/2026

Package	Affected versions	Patched versions
actionapps actionapps	`= 2.8.1`	No fix yet

Description

PHP remote file inclusion vulnerabilities in ActionApps 2.8.1 allow remote attackers to execute arbitrary PHP code via a URL in the GLOBALS[AA_INC_PATH] parameter in (1) cached.php3, (2) cron.php3, (3) discussion.php3, (4) filldisc.php3, (5) filler.php3, (6) fillform.php3, (7) go.php3, (8) hiercons.php3, (9) jsview.php3, (10) live_checkbox.php3, (11) offline.php3, (12) post2shtml.php3, (13) search.php3, (14) slice.php3, (15) sql_update.php3, (16) view.php3, (17) multiple files in the (18) admin/ folder, (19) includes folder, and (20) modules/ folder.

References

secunia.com/advisories/20299 · Exploit
osvdb.org/27253
osvdb.org/27254
osvdb.org/27256
osvdb.org/27257
osvdb.org/27258
osvdb.org/27259
osvdb.org/27260
osvdb.org/27261
osvdb.org/27262
osvdb.org/27263
osvdb.org/27264
osvdb.org/27265
osvdb.org/27266
osvdb.org/27267
osvdb.org/27268
osvdb.org/27269
osvdb.org/27270
osvdb.org/27271
osvdb.org/27272
osvdb.org/27273
osvdb.org/27274
osvdb.org/27275
osvdb.org/27276
osvdb.org/27277
osvdb.org/27278
osvdb.org/27279
osvdb.org/27280
osvdb.org/27281
osvdb.org/27282
osvdb.org/27283
osvdb.org/27284
osvdb.org/27285
osvdb.org/27286
osvdb.org/27287
osvdb.org/27288
osvdb.org/27289
osvdb.org/27290
osvdb.org/27291
osvdb.org/27292
osvdb.org/27293
osvdb.org/27294
osvdb.org/27295
osvdb.org/27296
osvdb.org/27297
osvdb.org/27298
osvdb.org/27299
osvdb.org/27300
osvdb.org/27301
osvdb.org/27302
osvdb.org/27303
osvdb.org/27304
osvdb.org/27305
osvdb.org/27306
osvdb.org/27308
osvdb.org/27309
osvdb.org/27310
securityfocus.com/bid/19133
vupen.com/english/advisories/2006/1997
exchange.xforce.ibmcloud.com/vulnerabilities/26776
exploit-db.com/exploits/1829

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free