Not a U.S. government website. NDD is an independent vulnerability database by Volerion and is not affiliated with or endorsed by NIST or NVD.

CVE-2006-3172 Details

Description

Multiple PHP remote file inclusion vulnerabilities in Content*Builder 0.7.5 allow remote attackers to execute arbitrary PHP code via a URL with a trailing slash (/) character in the (1) lang_path parameter to (a) cms/plugins/col_man/column.inc.php, (b) cms/plugins/poll/poll.inc.php, (c) cms/plugins/user_managment/usrPortrait.inc.php, (d) cms/plugins/user_managment/user.inc.php, (e) cms/plugins/media_manager/media.inc.php, (f) cms/plugins/events/permanent.eventMonth.inc.php, (g) cms/plugins/events/events.inc.php, and (h) cms/plugins/newsletter2/newsletter.inc.php; (2) path[cb] parameter to (i) modules/guestbook/guestbook.inc.php, (j) modules/shoutbox/shoutBox.php, and (k) modules/sitemap/sitemap.inc.php; and the (3) rel parameter to (l) modules/download/overview.inc.php, (m) modules/download/detailView.inc.php, (n) modules/article/fullarticle.inc.php, (o) modules/article/comments.inc.php, (p) modules/article2/overview.inc.php, (q) modules/article2/fullarticle.inc.php, (r) modules/article2/comments.inc.php, (s) modules/headline/headlineBox.php, and (t) modules/headline/showHeadline.inc.php.

Metrics

CVSS 3.x Severity and Vector Strings:

No CVSS 3.x data is available for this CVE.

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.

URL	Source(s)	Tag(s)
http://marc.info/?l=bugtraq&m=115016951316696&w=2	CVE
http://secunia.com/advisories/20557	CVE	ExploitVendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/27044	CVE
http://www.osvdb.org/26344	CVE	Exploit
http://www.osvdb.org/26345	CVE	Exploit
http://www.osvdb.org/26346	CVE	Exploit
http://www.osvdb.org/26347	CVE	Exploit
http://www.osvdb.org/26348	CVE	Exploit
http://www.osvdb.org/26349	CVE	Exploit
http://www.osvdb.org/26350	CVE	Exploit
http://www.osvdb.org/26351	CVE	Exploit
http://www.osvdb.org/26352	CVE	Exploit
http://www.osvdb.org/26353	CVE	Exploit
http://www.osvdb.org/26354	CVE	Exploit
http://www.osvdb.org/26355	CVE	Exploit
http://www.osvdb.org/26356	CVE	Exploit
http://www.osvdb.org/26357	CVE	Exploit
http://www.osvdb.org/26358	CVE	Exploit
http://www.osvdb.org/26359	CVE	Exploit
http://www.osvdb.org/26360	CVE	Exploit
http://www.osvdb.org/26361	CVE	Exploit
http://www.osvdb.org/26362	CVE	Exploit
http://www.osvdb.org/26363	CVE	Exploit
http://www.securityfocus.com/bid/18404	CVE	Exploit
http://www.vupen.com/english/advisories/2006/2300	CVE	Vendor Advisory
http://marc.info/?l=bugtraq&m=115016951316696&w=2	[email protected]
http://secunia.com/advisories/20557	[email protected]	ExploitVendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/27044	[email protected]
http://www.osvdb.org/26344	[email protected]	Exploit
http://www.osvdb.org/26345	[email protected]	Exploit
http://www.osvdb.org/26346	[email protected]	Exploit
http://www.osvdb.org/26347	[email protected]	Exploit
http://www.osvdb.org/26348	[email protected]	Exploit
http://www.osvdb.org/26349	[email protected]	Exploit
http://www.osvdb.org/26350	[email protected]	Exploit
http://www.osvdb.org/26351	[email protected]	Exploit
http://www.osvdb.org/26352	[email protected]	Exploit
http://www.osvdb.org/26353	[email protected]	Exploit
http://www.osvdb.org/26354	[email protected]	Exploit
http://www.osvdb.org/26355	[email protected]	Exploit
http://www.osvdb.org/26356	[email protected]	Exploit
http://www.osvdb.org/26357	[email protected]	Exploit
http://www.osvdb.org/26358	[email protected]	Exploit
http://www.osvdb.org/26359	[email protected]	Exploit
http://www.osvdb.org/26360	[email protected]	Exploit
http://www.osvdb.org/26361	[email protected]	Exploit
http://www.osvdb.org/26362	[email protected]	Exploit
http://www.osvdb.org/26363	[email protected]	Exploit
http://www.securityfocus.com/bid/18404	[email protected]	Exploit
http://www.vupen.com/english/advisories/2006/2300	[email protected]	Vendor Advisory

see all 50 references

Weakness Enumeration

CWE-ID	CWE Name	Source
CWE-94	Improper Control of Generation of Code ('Code Injection')	[email protected]

Affected Products

Product	Versions
contentbuilder contentbuilder	0.7.5
CPE cpe:2.3:a:contentbuilder:contentbuilder:0.7.5:::::::* Remediation No remediation found in references.

Change History

9 change records found show changes

Date	Action	Recorded By
Jun 16, 2026	CVE Modified	[email protected]
Apr 16, 2026		[email protected]
Nov 21, 2024	CVE Modified	CVE
May 14, 2024	CVE Modified	[email protected]
Jul 20, 2017	CVE Modified	[email protected]
Dec 7, 2016	CVE Modified	[email protected]
Oct 20, 2016	CVE Translated	[email protected]
Oct 18, 2016	CVE Modified	[email protected]
Jun 23, 2006	Initial Analysis	[email protected]