$ cve CVE-2006-1747 JSON

CVE-2006-1747 EXPLOIT

7.5

HIGH · CVSS 2.0 · EPSS 4% (pctl 90)

Patch early

A public exploit exists.

Description

PHP remote file inclusion vulnerability in Virtual War (VWar) 1.5.0 allows remote attackers to execute arbitrary PHP code via a URL in the vwar_root parameter to (1) admin/admin.php, (2) war.php, (3) stats.php, (4) news.php, (5) joinus.php, (6) challenge.php, (7) calendar.php, (8) member.php, (9) popup.php, and other unspecified scripts in the admin folder. NOTE: these are different attack vectors than CVE-2006-1636 and CVE-2006-1503.

Scoring

CVSS	7.5 (HIGH, v2.0)
Vector	AV:N/AC:L/Au:N/C:P/I:P/A:P
EPSS	3.99% — more likely to be exploited than 90% of all CVEs
On CISA KEV	no
Public exploit	yes
Published	2006-04-12
Last modified	2026-06-16

Affected (1)

Vendor	Product
vwar	virtual war

Public exploits

Source	Title	Date
exploit-db	VWar 1.5 - 'war.php?vwar_root' Remote File Inclusion	2006-08-07
exploit-db	VWar 1.5 - 'member.php?vwar_root' Remote File Inclusion	2006-08-07
exploit-db	VWar 1.5 - 'calendar.php?vwar_root' Remote File Inclusion	2006-08-07
exploit-db	VWar 1.5 - 'challenge.php?vwar_root' Remote File Inclusion	2006-08-07
exploit-db	VWar 1.5 - 'joinus.php?vwar_root' Remote File Inclusion	2006-08-07
exploit-db	VWar 1.5 - 'news.php?vwar_root' Remote File Inclusion	2006-08-07
exploit-db	VWar 1.5 - 'stats.php?vwar_root' Remote File Inclusion	2006-08-07

References

→ the Explorer · watch your stack · NVD