{"id":"CVE-2006-1767","aliases":["EUVD-2006-1767","GHSA-9rm5-4hr2-rwg6"],"status":"published","title":"Multiple PHP remote file inclusion vulnerabilities in nicecoder.com INDEXU 5.0.0 and 5.0.1 allow...","description":"Multiple PHP remote file inclusion vulnerabilities in nicecoder.com INDEXU 5.0.0 and 5.0.1 allow remote attackers to execute arbitrary PHP code via a URL in the theme_path parameter in (1) index.php, (2) become_editor.php, (3) add.php, (4) bad_link.php, (5) browse.php, (6) detail.php, (7) fav.php, (8) get_rated.php, (9) login.php, (10) mailing_list.php, (11) new.php, (12) modify.php, (13) pick.php, (14) power_search.php, (15) rating.php, (16) register.php, (17) review.php, (18) rss.php, (19) search.php, (20) send_pwd.php, (21) sendmail.php, (22) tell_friend.php, (23) top_rated.php, (24) user_detail.php, and (25) user_search.php; and the (26) base_path parameter in invoice.php.","severity":{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-10","score":0.08308,"percentile":0.94976,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":false},"published":"2006-04-13T10:00:00Z","modified":"2026-06-16T22:23:38Z","exploits":[{"source":"exploitdb","id":"EDB-27625","title":"Indexu 5.0 - Multiple Remote File Inclusions","type":"webapps","platform":"php","date":"2006-04-11","verified":true,"url":"https://www.exploit-db.com/exploits/27625"},{"source":"exploitdb","id":"EDB-1925","title":"Indexu 5.0.1 - 'admin_template_path' Remote File Inclusion","type":"webapps","platform":"php","date":"2006-06-18","verified":true,"url":"https://www.exploit-db.com/exploits/1925"}],"products":[{"vendor":"nicecoder","product":"indexu"}],"references":[{"url":"http://www.securityfocus.com/archive/1/430599/100/0/threaded","tags":["mailing-list","x_refsource_BUGTRAQ","x_transferred"]},{"url":"http://www.osvdb.org/28415","tags":["vdb-entry","x_refsource_OSVDB","x_transferred"]},{"url":"http://www.osvdb.org/28426","tags":["vdb-entry","x_refsource_OSVDB","x_transferred"]},{"url":"http://www.securityfocus.com/bid/17470","tags":["vdb-entry","x_refsource_BID","x_transferred","Exploit"]},{"url":"http://www.osvdb.org/28406","tags":["vdb-entry","x_refsource_OSVDB","x_transferred"]},{"url":"http://www.osvdb.org/28412","tags":["vdb-entry","x_refsource_OSVDB","x_transferred"]},{"url":"http://securitytracker.com/id?1015891","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred","Exploit"]},{"url":"http://www.osvdb.org/28419","tags":["vdb-entry","x_refsource_OSVDB","x_transferred"]},{"url":"http://www.osvdb.org/28410","tags":["vdb-entry","x_refsource_OSVDB","x_transferred"]},{"url":"http://www.osvdb.org/28417","tags":["vdb-entry","x_refsource_OSVDB","x_transferred"]},{"url":"http://www.osvdb.org/28427","tags":["vdb-entry","x_refsource_OSVDB","x_transferred"]},{"url":"http://www.osvdb.org/28422","tags":["vdb-entry","x_refsource_OSVDB","x_transferred"]},{"url":"http://www.osvdb.org/24597","tags":["vdb-entry","x_refsource_OSVDB","x_transferred"]},{"url":"http://ftp.kep.online.fr/Indexu_5.0.1_File_Inclusion_Exploit-by_King-Hacker_and-Khamaileon.txt","tags":["x_refsource_MISC","x_transferred"]},{"url":"http://www.osvdb.org/24596","tags":["vdb-entry","x_refsource_OSVDB","x_transferred"]},{"url":"http://securitytracker.com/id?1016331","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred"]},{"url":"http://www.osvdb.org/28416","tags":["vdb-entry","x_refsource_OSVDB","x_transferred"]},{"url":"http://www.osvdb.org/28425","tags":["vdb-entry","x_refsource_OSVDB","x_transferred"]},{"url":"http://www.osvdb.org/28413","tags":["vdb-entry","x_refsource_OSVDB","x_transferred"]},{"url":"http://www.osvdb.org/28409","tags":["vdb-entry","x_refsource_OSVDB","x_transferred"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2006-1767"},{"url":"https://github.com/advisories/GHSA-9rm5-4hr2-rwg6"}],"sources":{"cve":[{"id":"CVE-2006-1767","description":"Multiple PHP remote file inclusion vulnerabilities in nicecoder.com INDEXU 5.0.0 and 5.0.1 allow remote attackers to execute arbitrary PHP code via a URL in the theme_path parameter in (1) index.php, (2) become_editor.php, (3) add.php, (4) bad_link.php, (5) browse.php, (6) detail.php, (7) fav.php, (8) get_rated.php, (9) login.php, (10) mailing_list.php, (11) new.php, (12) modify.php, (13) pick.php, (14) power_search.php, (15) rating.php, (16) register.php, (17) review.php, (18) rss.php, (19) search.php, (20) send_pwd.php, (21) sendmail.php, (22) tell_friend.php, (23) top_rated.php, (24) user_detail.php, and (25) user_search.php; and the (26) base_path parameter in invoice.php.","status":"published","published":"2006-04-13T10:00:00Z","modified":"2024-08-07T17:27:28.318Z","updated_at":"2026-11-02T14:33:51.835276Z"}],"euvd":[{"id":"EUVD-2006-1767","description":"Multiple PHP remote file inclusion vulnerabilities in nicecoder.com INDEXU 5.0.0 and 5.0.1 allow remote attackers to execute arbitrary PHP code via a URL in the theme_path parameter in (1) index.php, (2) become_editor.php, (3) add.php, (4) bad_link.php, (5) browse.php, (6) detail.php, (7) fav.php, (8) get_rated.php, (9) login.php, (10) mailing_list.php, (11) new.php, (12) modify.php, (13) pick.php, (14) power_search.php, (15) rating.php, (16) register.php, (17) review.php, (18) rss.php, (19) search.php, (20) send_pwd.php, (21) sendmail.php, (22) tell_friend.php, (23) top_rated.php, (24) user_detail.php, and (25) user_search.php; and the (26) base_path parameter in invoice.php.","status":"published","published":"2006-04-13T10:00:00Z","modified":"2024-08-07T17:27:28Z","updated_at":"2026-11-03T01:16:03.620369Z"}],"ghsa":[{"id":"GHSA-9rm5-4hr2-rwg6","title":"Multiple PHP remote file inclusion vulnerabilities in nicecoder.com INDEXU 5.0.0 and 5.0.1 allow...","description":"Multiple PHP remote file inclusion vulnerabilities in nicecoder.com INDEXU 5.0.0 and 5.0.1 allow remote attackers to execute arbitrary PHP code via a URL in the theme_path parameter in (1) index.php, (2) become_editor.php, (3) add.php, (4) bad_link.php, (5) browse.php, (6) detail.php, (7) fav.php, (8) get_rated.php, (9) login.php, (10) mailing_list.php, (11) new.php, (12) modify.php, (13) pick.php, (14) power_search.php, (15) rating.php, (16) register.php, (17) review.php, (18) rss.php, (19) search.php, (20) send_pwd.php, (21) sendmail.php, (22) tell_friend.php, (23) top_rated.php, (24) user_detail.php, and (25) user_search.php; and the (26) base_path parameter in invoice.php.","status":"published","published":"2022-05-01T06:52:37Z","modified":"2023-01-31T05:01:10Z","updated_at":"2026-11-02T14:48:00.503412Z"}],"nvd":[{"id":"CVE-2006-1767","description":"Multiple PHP remote file inclusion vulnerabilities in nicecoder.com INDEXU 5.0.0 and 5.0.1 allow remote attackers to execute arbitrary PHP code via a URL in the theme_path parameter in (1) index.php, (2) become_editor.php, (3) add.php, (4) bad_link.php, (5) browse.php, (6) detail.php, (7) fav.php, (8) get_rated.php, (9) login.php, (10) mailing_list.php, (11) new.php, (12) modify.php, (13) pick.php, (14) power_search.php, (15) rating.php, (16) register.php, (17) review.php, (18) rss.php, (19) search.php, (20) send_pwd.php, (21) sendmail.php, (22) tell_friend.php, (23) top_rated.php, (24) user_detail.php, and (25) user_search.php; and the (26) base_path parameter in invoice.php.","status":"published","published":"2006-04-13T10:02:00Z","modified":"2026-06-16T22:23:38.63Z","cvss":[{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary"}],"updated_at":"2026-11-02T14:01:02.433957Z"}]}}