製品・ソフトウェアに関する情報

JVN脆弱性詳細

Comdev CSV Importer の include.php における PHP リモートファイルインクルージョンの脆弱性

タイトル	Comdev CSV Importer の include.php における PHP リモートファイルインクルージョンの脆弱性
概要	以下の製品で使用される Comdev CSV Importer の include.php は、PHP リモートファイルインクルージョンの脆弱性が存在します。 (1) Comdev Contact Form (2) Comdev Customer Helpdesk (3) Comdev Events Calendar (4) Comdev FAQ Support (5) Comdev Guestbook (6) Comdev Links Directory (7) Comdev News Publisher (8) Comdev Newsletter (9) Comdev Photo Gallery (10) Comdev Vote Caster (11) Comdev Web Blogger (12) Comdev eCommerce
想定される影響	第三者により、path[docroot] パラメータの URL を介して、任意の PHP コードが実行される可能性があります。
対策	ベンダ情報および参考情報を参照して適切な対策を実施してください。
公表日	2006年10月3日0:00
登録日	2012年6月26日15:37
最終更新日	2012年6月26日15:37

CVSS2.0 : 危険
スコア	7.5
ベクター	AV:N/AC:L/Au:N/C:P/I:P/A:P

影響を受けるシステム

comdev

comdev csv importer 3.1 および 4.1

CVE (情報セキュリティ共通脆弱性識別子)

No	名前	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2006-5101	http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-5101
National Vulnerability Database (NVD)
2	CVE-2006-5101	http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2006-5101

CWE (共通脆弱性タイプ一覧)

No	名前	URL
JVNDB
1	CWE-94	https://jvndb.jvn.jp/ja/cwe/CWE-94.html

ベンダー情報

No	名前	URL
comdev
1	Top Page	http://www.comdevweb.com/index.php

変更履歴

No	変更内容	変更日
0	[2012年06月26日] 掲載	2018年2月17日10:37

NVD脆弱性情報

CVE-2006-5101

概要	PHP remote file inclusion vulnerability in include.php in Comdev CSV Importer 3.1 and possibly 4.1, as used in (1) Comdev Contact Form 3.1, (2) Comdev Customer Helpdesk 3.1, (3) Comdev Events Calendar 3.1, (4) Comdev FAQ Support 3.1, (5) Comdev Guestbook 3.1, (6) Comdev Links Directory 3.1, (7) Comdev News Publisher 3.1, (8) Comdev Newsletter 3.1, (9) Comdev Photo Gallery 3.1, (10) Comdev Vote Caster 3.1, (11) Comdev Web Blogger 3.1, and (12) Comdev eCommerce 3.1, allows remote attackers to execute arbitrary PHP code via a URL in the path[docroot] parameter. NOTE: it has been reported that 4.1 versions might also be affected.
概要	Vulnerabilidad PHP de inclusión remota de archivo en include.php en Comdev CSV Importer 3.1 y posiblemente 4.1, utilizado en (1) Comdev Contact Form 3.1, (2) Comdev Customer Helpdesk 3.1, (3) Comdev Events Calendar 3.1, (4) Comdev FAQ Support 3.1, (5) Comdev Guestbook 3.1, (6) Comdev Links Directory 3.1, (7) Comdev News Publisher 3.1, (8) Comdev Newsletter 3.1, (9) Comdev Photo Gallery 3.1, (10) Comdev Vote Caster 3.1, (11) Comdev Web Blogger 3.1, y (12) Comdev eCommerce 3.1, permite a un atacante remoto ejecutar código PHP de su elección a través de un URL en el parámetro path["docroot"].
公表日	2006年10月3日13:03
登録日	2021年1月29日15:46
最終更新日	2026年4月23日9:35

影響を受けるソフトウェアの構成

構成1	以上	以下	より上	未満
cpe:2.3:a:comdev:comdev_csv_importer:3.1:::::::*
cpe:2.3:a:comdev:comdev_csv_importer:4.1:::::::*

関連情報、対策とツール

No	URL	refsource
1	http://secunia.com/advisories/22133	cve@mitre.org
2	http://secunia.com/advisories/22134	cve@mitre.org
3	http://secunia.com/advisories/22135	cve@mitre.org
4	http://secunia.com/advisories/22147	cve@mitre.org
5	http://secunia.com/advisories/22149	cve@mitre.org
6	http://secunia.com/advisories/22151	cve@mitre.org
7	http://secunia.com/advisories/22153	cve@mitre.org
8	http://secunia.com/advisories/22154	cve@mitre.org
9	http://secunia.com/advisories/22157	cve@mitre.org
10	http://secunia.com/advisories/22168	cve@mitre.org
11	http://secunia.com/advisories/22169	cve@mitre.org
12	http://secunia.com/advisories/22170	cve@mitre.org
13	http://securityreason.com/securityalert/1658	cve@mitre.org
14	http://www.osvdb.org/29299	cve@mitre.org
15	http://www.osvdb.org/29300	cve@mitre.org
16	http://www.osvdb.org/29301	cve@mitre.org
17	http://www.osvdb.org/29302	cve@mitre.org
18	http://www.osvdb.org/29303	cve@mitre.org
19	http://www.osvdb.org/29304	cve@mitre.org
20	http://www.osvdb.org/29305	cve@mitre.org
21	http://www.osvdb.org/29306	cve@mitre.org
22	http://www.osvdb.org/29307	cve@mitre.org
23	http://www.osvdb.org/29308	cve@mitre.org
24	http://www.osvdb.org/29309	cve@mitre.org
25	http://www.osvdb.org/29310	cve@mitre.org
26	http://www.osvdb.org/29311	cve@mitre.org
27	http://www.securityfocus.com/archive/1/447184/100/0/threaded	cve@mitre.org
28	http://www.securityfocus.com/archive/1/447185/100/0/threaded	cve@mitre.org
29	http://www.securityfocus.com/archive/1/447186/100/0/threaded	cve@mitre.org
30	http://www.securityfocus.com/archive/1/447187/100/0/threaded	cve@mitre.org
31	http://www.securityfocus.com/archive/1/447188/100/0/threaded	cve@mitre.org
32	http://www.securityfocus.com/archive/1/447190/100/0/threaded	cve@mitre.org
33	http://www.securityfocus.com/archive/1/447192/100/0/threaded	cve@mitre.org
34	http://www.securityfocus.com/archive/1/447193/100/0/threaded	cve@mitre.org
35	http://www.securityfocus.com/archive/1/447194/100/0/threaded	cve@mitre.org
36	http://www.securityfocus.com/archive/1/447201/100/0/threaded	cve@mitre.org
37	http://www.securityfocus.com/archive/1/447207/100/0/threaded	cve@mitre.org
38	http://www.securityfocus.com/archive/1/447209/100/0/threaded	cve@mitre.org
39	http://www.securityfocus.com/archive/1/447213/100/0/threaded	cve@mitre.org
40	http://www.vupen.com/english/advisories/2006/3803	cve@mitre.org
41	http://www.vupen.com/english/advisories/2006/3804	cve@mitre.org
42	http://www.vupen.com/english/advisories/2006/3805	cve@mitre.org
43	http://www.vupen.com/english/advisories/2006/3806	cve@mitre.org
44	http://www.vupen.com/english/advisories/2006/3807	cve@mitre.org
45	http://www.vupen.com/english/advisories/2006/3808	cve@mitre.org
46	http://www.vupen.com/english/advisories/2006/3809	cve@mitre.org
47	http://www.vupen.com/english/advisories/2006/3810	cve@mitre.org
48	http://www.vupen.com/english/advisories/2006/3811	cve@mitre.org
49	http://www.vupen.com/english/advisories/2006/3812	cve@mitre.org
50	http://www.vupen.com/english/advisories/2006/3813	cve@mitre.org
51	http://www.vupen.com/english/advisories/2006/3814	cve@mitre.org
52	http://www.vupen.com/english/advisories/2006/3815	cve@mitre.org
53	https://exchange.xforce.ibmcloud.com/vulnerabilities/29220	cve@mitre.org
54	http://secunia.com/advisories/22133	af854a3a-2127-422b-91ae-364da2661108
55	http://secunia.com/advisories/22134	af854a3a-2127-422b-91ae-364da2661108
56	http://secunia.com/advisories/22135	af854a3a-2127-422b-91ae-364da2661108
57	http://secunia.com/advisories/22147	af854a3a-2127-422b-91ae-364da2661108
58	http://secunia.com/advisories/22149	af854a3a-2127-422b-91ae-364da2661108
59	http://secunia.com/advisories/22151	af854a3a-2127-422b-91ae-364da2661108
60	http://secunia.com/advisories/22153	af854a3a-2127-422b-91ae-364da2661108
61	http://secunia.com/advisories/22154	af854a3a-2127-422b-91ae-364da2661108
62	http://secunia.com/advisories/22157	af854a3a-2127-422b-91ae-364da2661108
63	http://secunia.com/advisories/22168	af854a3a-2127-422b-91ae-364da2661108
64	http://secunia.com/advisories/22169	af854a3a-2127-422b-91ae-364da2661108
65	http://secunia.com/advisories/22170	af854a3a-2127-422b-91ae-364da2661108
66	http://securityreason.com/securityalert/1658	af854a3a-2127-422b-91ae-364da2661108
67	http://www.osvdb.org/29299	af854a3a-2127-422b-91ae-364da2661108
68	http://www.osvdb.org/29300	af854a3a-2127-422b-91ae-364da2661108
69	http://www.osvdb.org/29301	af854a3a-2127-422b-91ae-364da2661108
70	http://www.osvdb.org/29302	af854a3a-2127-422b-91ae-364da2661108
71	http://www.osvdb.org/29303	af854a3a-2127-422b-91ae-364da2661108
72	http://www.osvdb.org/29304	af854a3a-2127-422b-91ae-364da2661108
73	http://www.osvdb.org/29305	af854a3a-2127-422b-91ae-364da2661108
74	http://www.osvdb.org/29306	af854a3a-2127-422b-91ae-364da2661108
75	http://www.osvdb.org/29307	af854a3a-2127-422b-91ae-364da2661108
76	http://www.osvdb.org/29308	af854a3a-2127-422b-91ae-364da2661108
77	http://www.osvdb.org/29309	af854a3a-2127-422b-91ae-364da2661108
78	http://www.osvdb.org/29310	af854a3a-2127-422b-91ae-364da2661108
79	http://www.osvdb.org/29311	af854a3a-2127-422b-91ae-364da2661108
80	http://www.securityfocus.com/archive/1/447184/100/0/threaded	af854a3a-2127-422b-91ae-364da2661108
81	http://www.securityfocus.com/archive/1/447185/100/0/threaded	af854a3a-2127-422b-91ae-364da2661108
82	http://www.securityfocus.com/archive/1/447186/100/0/threaded	af854a3a-2127-422b-91ae-364da2661108
83	http://www.securityfocus.com/archive/1/447187/100/0/threaded	af854a3a-2127-422b-91ae-364da2661108
84	http://www.securityfocus.com/archive/1/447188/100/0/threaded	af854a3a-2127-422b-91ae-364da2661108
85	http://www.securityfocus.com/archive/1/447190/100/0/threaded	af854a3a-2127-422b-91ae-364da2661108
86	http://www.securityfocus.com/archive/1/447192/100/0/threaded	af854a3a-2127-422b-91ae-364da2661108
87	http://www.securityfocus.com/archive/1/447193/100/0/threaded	af854a3a-2127-422b-91ae-364da2661108
88	http://www.securityfocus.com/archive/1/447194/100/0/threaded	af854a3a-2127-422b-91ae-364da2661108
89	http://www.securityfocus.com/archive/1/447201/100/0/threaded	af854a3a-2127-422b-91ae-364da2661108
90	http://www.securityfocus.com/archive/1/447207/100/0/threaded	af854a3a-2127-422b-91ae-364da2661108
91	http://www.securityfocus.com/archive/1/447209/100/0/threaded	af854a3a-2127-422b-91ae-364da2661108
92	http://www.securityfocus.com/archive/1/447213/100/0/threaded	af854a3a-2127-422b-91ae-364da2661108
93	http://www.vupen.com/english/advisories/2006/3803	af854a3a-2127-422b-91ae-364da2661108
94	http://www.vupen.com/english/advisories/2006/3804	af854a3a-2127-422b-91ae-364da2661108
95	http://www.vupen.com/english/advisories/2006/3805	af854a3a-2127-422b-91ae-364da2661108
96	http://www.vupen.com/english/advisories/2006/3806	af854a3a-2127-422b-91ae-364da2661108
97	http://www.vupen.com/english/advisories/2006/3807	af854a3a-2127-422b-91ae-364da2661108
98	http://www.vupen.com/english/advisories/2006/3808	af854a3a-2127-422b-91ae-364da2661108
99	http://www.vupen.com/english/advisories/2006/3809	af854a3a-2127-422b-91ae-364da2661108
100	http://www.vupen.com/english/advisories/2006/3810	af854a3a-2127-422b-91ae-364da2661108
101	http://www.vupen.com/english/advisories/2006/3811	af854a3a-2127-422b-91ae-364da2661108
102	http://www.vupen.com/english/advisories/2006/3812	af854a3a-2127-422b-91ae-364da2661108
103	http://www.vupen.com/english/advisories/2006/3813	af854a3a-2127-422b-91ae-364da2661108
104	http://www.vupen.com/english/advisories/2006/3814	af854a3a-2127-422b-91ae-364da2661108
105	http://www.vupen.com/english/advisories/2006/3815	af854a3a-2127-422b-91ae-364da2661108
106	https://exchange.xforce.ibmcloud.com/vulnerabilities/29220	af854a3a-2127-422b-91ae-364da2661108

共通脆弱性一覧

No	CWE	名前	URL
1	CWE-94	コード・インジェクション	https://cwe.mitre.org/data/definitions/94.html