CVE Feed

Dashboard / CVE / CVE-2006-5020

CVE-2006-5020

Multiple PHP remote file inclusion vulnerabilities in SolidState 0.4 and earlier allow remote attackers to execute arbitrary PHP code via a URL in the base_path parameter in manager/pages/ scripts including (1) AccountsPage.class.php, (2) AddInvoicePage.class.php, (3) AddIPAddressPage.class.php, (4) AddPaymentPage.class.php, (5) AddTaxRulePage.class.php, (6) AssignDomainPage.class.php, (7) AssignHostingPage.class.php, (8) AssignProductPage.class.php, (9) BillingPage.class.php, (10) BillingPaymentPage.class.php, (11) BrowseAccountsPage.class.php, (12) BrowseInvoicesPage.class.php, (13) ConfigureEditUserPage.class.php, (14) ConfigureNewUserPage.class.php, (15) ConfigureNewUserReceiptPage.class.php, (16) ConfigureUsersPage.class.php, (17) DeleteAccountPage.class.php, (18) DeleteDomainServicePage.class.php, (19) DeleteHostingServicePage.class.php, (20) DeleteInvoicePage.class.php, (21) DeleteProductPage.class.php, (22) DeleteServerPage.class.php, (23) DomainServicesPage.class.php, (24) DomainsPage.class.php, (25) EditAccountPage.class.php, (26) EditDomainPage.class.php, (27) EditDomainServicePage.class.php, (28) EditHostingServicePage.class.php, (29) EditPaymentPage.class.php, (30) EditProductPage.class.php, (31) EditServerPage.class.php, (32) EmailInvoicePage.class.php, (33) ExecuteOrderPage.class.php, (34) ExpiredDomainsPage.class.php, (35) FulfilledOrdersPage.class.php, (36) GenerateInvoicesPage.class.php, (37) HomePage.class.php, (38) InactiveAccountsPage.class.php, (39) IPManagerPage.class.php, (40) LoginPage.class.php, (41) LogPage.class.php, (42) ModulesPage.class.php, (43) NewAccountPage.class.php, (44) NewDomainServicePage.class.php, (45) NewProductPage.class.php, (46) OutstandingInvoicesPage.class.php, (47) PendingAccountsPage.class.php, (48) PendingOrdersPage.class.php, (49) PrintInvoicePage.class.php, (50) ProductsPage.class.php, (51) RegisterDomainPage.class.php, (52) RegisteredDomainsPage.class.php, (53) ServersPage.class.php, (54) ServicesHostingServicesPage.class.php, (55) ServicesNewHostingPage.class.php, (56) ServicesPage.class.php, (57) ServicesWebHostingPage.class.php, (58) SettingsPage.class.php, (59) TaxesPage.class.php, (60) TransferDomainPage.class.php, (61) ViewAccountPage.class.php, (62) ViewDomainServicePage.class.php, (63) ViewHostingServicePage.class.php, (64) ViewInvoicePage.class.php, (65) ViewLogMessagePage.class.php, (66) ViewOrderPage.class.php, (67) ViewProductPage.class.php, (68) ViewServerPage.class.php, (69) WelcomeEmailPage.class.php; and (70) modules/RegistrarModule.class.php, (71) modules/SolidStateModule.class.php, (72) modules/authorizeaim/authorizeaim.class.php, and (73) modules/authorizeaim/pages/AAIMConfigPage.class.php.

Published:Sep 27, 2006

Last Modified:Apr 23, 2026

EPS:Sep 27, 2006

EPSS Score:0.11044

CVSS Score:7.5

Affected Products

Vendor

Product

Action

Vendor

Solidstate

Product

Solidstate

Solidstate

Solidstate

Exploits

https://www.exploit-db.com/exploits/2413

Common Weakness Enumeration

No CWE recorded yet

Common Attack Pattern Enumeration and Classification (CAPEC)

No CAPEC recorded yet

References

http://attrition.org/pipermail/vim/2007-January/001210.html

http://www.osvdb.org/31097

http://www.osvdb.org/31098

http://www.osvdb.org/31099

http://www.osvdb.org/31100

http://www.osvdb.org/31104

http://www.osvdb.org/31105

http://www.osvdb.org/31106

http://www.osvdb.org/31107

http://www.osvdb.org/31108

http://www.osvdb.org/31109

http://www.osvdb.org/31110

http://www.osvdb.org/31111

http://www.osvdb.org/31112

http://www.osvdb.org/31113

http://www.osvdb.org/31114

http://www.osvdb.org/31115

http://www.osvdb.org/31116

http://www.osvdb.org/31117

http://www.osvdb.org/31118

http://www.osvdb.org/31119

http://www.osvdb.org/31120

http://www.osvdb.org/31121

http://www.osvdb.org/31122

http://www.osvdb.org/31123

http://www.osvdb.org/31124

http://www.osvdb.org/31125

http://www.osvdb.org/31126

http://www.osvdb.org/31127

http://www.osvdb.org/31128

http://www.osvdb.org/31129

http://www.osvdb.org/31130

http://www.osvdb.org/31131

http://www.osvdb.org/31132

http://www.osvdb.org/31133

http://www.osvdb.org/31134

http://www.osvdb.org/31135

http://www.osvdb.org/31136

http://www.osvdb.org/31137

http://www.osvdb.org/31138

http://www.osvdb.org/31139

http://www.osvdb.org/31141

http://www.osvdb.org/31142

http://www.osvdb.org/31143

http://www.osvdb.org/31144

http://www.osvdb.org/31145

http://www.osvdb.org/31146

http://www.osvdb.org/31147

http://www.osvdb.org/31190

http://www.osvdb.org/31191

http://www.osvdb.org/31192

http://www.osvdb.org/31193

http://www.osvdb.org/31194

http://www.osvdb.org/31197

http://www.osvdb.org/31198

http://www.osvdb.org/31199

http://www.osvdb.org/31200

http://www.osvdb.org/31201

http://www.osvdb.org/31202

http://www.osvdb.org/31203

http://www.securityfocus.com/bid/21934

http://www.solid-state.org/index.php?name=PNphpBB2&file=portal&article=1

https://exchange.xforce.ibmcloud.com/vulnerabilities/29095

https://www.exploit-db.com/exploits/2413

http://attrition.org/pipermail/vim/2007-January/001210.html

http://www.osvdb.org/31097

http://www.osvdb.org/31098

http://www.osvdb.org/31099

http://www.osvdb.org/31100

http://www.osvdb.org/31104

http://www.osvdb.org/31105

http://www.osvdb.org/31106

http://www.osvdb.org/31107

http://www.osvdb.org/31108

http://www.osvdb.org/31109

http://www.osvdb.org/31110

http://www.osvdb.org/31111

http://www.osvdb.org/31112

http://www.osvdb.org/31113

http://www.osvdb.org/31114

http://www.osvdb.org/31115

http://www.osvdb.org/31116

http://www.osvdb.org/31117

http://www.osvdb.org/31118

http://www.osvdb.org/31119

http://www.osvdb.org/31120

http://www.osvdb.org/31121

http://www.osvdb.org/31122

http://www.osvdb.org/31123

http://www.osvdb.org/31124

http://www.osvdb.org/31125

http://www.osvdb.org/31126

http://www.osvdb.org/31127

http://www.osvdb.org/31128

http://www.osvdb.org/31129

http://www.osvdb.org/31130

http://www.osvdb.org/31131

http://www.osvdb.org/31132

http://www.osvdb.org/31133

http://www.osvdb.org/31134

http://www.osvdb.org/31135

http://www.osvdb.org/31136

http://www.osvdb.org/31137

http://www.osvdb.org/31138

http://www.osvdb.org/31139

http://www.osvdb.org/31141

http://www.osvdb.org/31142

http://www.osvdb.org/31143

http://www.osvdb.org/31144

http://www.osvdb.org/31145

http://www.osvdb.org/31146

http://www.osvdb.org/31147

http://www.osvdb.org/31190

http://www.osvdb.org/31191

http://www.osvdb.org/31192

http://www.osvdb.org/31193

http://www.osvdb.org/31194

http://www.osvdb.org/31197

http://www.osvdb.org/31198

http://www.osvdb.org/31199

http://www.osvdb.org/31200

http://www.osvdb.org/31201

http://www.osvdb.org/31202

http://www.osvdb.org/31203

http://www.securityfocus.com/bid/21934

http://www.solid-state.org/index.php?name=PNphpBB2&file=portal&article=1

https://exchange.xforce.ibmcloud.com/vulnerabilities/29095

https://www.exploit-db.com/exploits/2413

Common Vulnerability Scoring System

Attack Vector

Network

Adjacent

Local

Physical

Privileges Required

None

Low

High

User Interaction

None

Required

Scope

Unchanged

Changed

Confidentiality

None

Low

High

Integrity

None

Low

High

Availability

None

Low

High