Not a U.S. government website. NDD is an independent vulnerability database by Volerion and is not affiliated with or endorsed by NIST or NVD.

CVE-2006-6740 Details

Description

Multiple PHP remote file inclusion vulnerabilities in phpProfiles 3.1.2b and earlier allow remote attackers to execute arbitrary PHP code via a URL in the menu parameter to (1) include/body.inc.php or (2) include/body_admin.inc.php; or a URL in the incpath parameter to (3) index.inc.php, (4) account.inc.php, (5) admin_newcomm.inc.php, (6) header_admin.inc.php, (7) header.inc.php, (8) friends.inc.php, (9) menu_u.inc.php, (10) notify.inc.php, (11) body.inc.php, (12) body_admin.inc.php, (13) commrecc.inc.php, (14) do_reg.inc.php, (15) comm_post.inc.php, or (16) menu_v.inc.php in include/, different vectors than CVE-2006-5634. NOTE: The provenance of this information is unknown; the details are obtained solely from third party information.

Metrics

CVSS 3.x Severity and Vector Strings:

No CVSS 3.x data is available for this CVE.

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.

URL	Source(s)	Tag(s)
http://linuxwebshop.com/forum/viewtopic.php?t=40	CVE	URL Repurposed
http://secunia.com/advisories/23423	CVE	Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/30997	CVE
https://www.exploit-db.com/exploits/2956	CVE
http://www.attrition.org/pipermail/vim/2007-March/001401.html	CVE
http://www.osvdb.org/32363	CVE
http://www.osvdb.org/32364	CVE
http://www.osvdb.org/32365	CVE
http://www.osvdb.org/32366	CVE
http://www.osvdb.org/32367	CVE
http://www.osvdb.org/32368	CVE
http://www.osvdb.org/32369	CVE
http://www.osvdb.org/32370	CVE
http://www.osvdb.org/32371	CVE
http://www.osvdb.org/32372	CVE
http://www.osvdb.org/32373	CVE
http://www.osvdb.org/32374	CVE
http://www.osvdb.org/32375	CVE
http://www.osvdb.org/32376	CVE
http://www.securityfocus.com/bid/21667	CVE	Exploit
http://www.vupen.com/english/advisories/2006/5087	CVE
http://linuxwebshop.com/forum/viewtopic.php?t=40	[email protected]	URL Repurposed
http://secunia.com/advisories/23423	[email protected]	Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/30997	[email protected]
https://www.exploit-db.com/exploits/2956	[email protected]
http://www.attrition.org/pipermail/vim/2007-March/001401.html	[email protected]
http://www.osvdb.org/32363	[email protected]
http://www.osvdb.org/32364	[email protected]
http://www.osvdb.org/32365	[email protected]
http://www.osvdb.org/32366	[email protected]
http://www.osvdb.org/32367	[email protected]
http://www.osvdb.org/32368	[email protected]
http://www.osvdb.org/32369	[email protected]
http://www.osvdb.org/32370	[email protected]
http://www.osvdb.org/32371	[email protected]
http://www.osvdb.org/32372	[email protected]
http://www.osvdb.org/32373	[email protected]
http://www.osvdb.org/32374	[email protected]
http://www.osvdb.org/32375	[email protected]
http://www.osvdb.org/32376	[email protected]
http://www.securityfocus.com/bid/21667	[email protected]	Exploit
http://www.vupen.com/english/advisories/2006/5087	[email protected]

see all 42 references

Weakness Enumeration

CWE-ID	CWE Name	Source
CWE-94	Improper Control of Generation of Code ('Code Injection')	[email protected]

Affected Products

Product	Versions
phpprofiles phpprofiles	<= 3.1.2b 2.1
CPE cpe:2.3:a:phpprofiles:phpprofiles:::::::: cpe:2.3:a:phpprofiles:phpprofiles:2.1:::::::* Remediation No remediation found in references.

Change History

8 change records found show changes

Date	Action	Recorded By
Jun 16, 2026	CVE Modified	[email protected]
Apr 23, 2026	Status Change	[email protected]
Nov 21, 2024	CVE Modified	CVE
May 14, 2024	CVE Modified	[email protected]
Feb 14, 2024	Reference Tag Update	[email protected]
Oct 19, 2017	CVE Modified	[email protected]
Jul 29, 2017	CVE Modified	[email protected]
Dec 27, 2006	Initial Analysis	[email protected]