$ cve CVE-2006-3175 JSON

CVE-2006-3175 EXPLOIT

7.5

HIGH · CVSS 2.0 · EPSS 9% (pctl 95)

Patch early

A public exploit exists.

Description

Multiple PHP remote file inclusion vulnerabilities in mcGuestbook 1.3 allow remote attackers to execute arbitrary PHP code via a URL in the lang parameter to (1) admin.php, (2) ecrire.php, and (3) lire.php. NOTE: it was later reported that the ecrire.php vector also affects 1.2. NOTE: this issue might be limited to a race condition during installation or an improper installation, since a completed installation creates an include file that prevents external control of the $lang variable.

Scoring

CVSS	7.5 (HIGH, v2.0)
Vector	AV:N/AC:L/Au:N/C:P/I:P/A:P
EPSS	9.01% — more likely to be exploited than 95% of all CVEs
Weakness	CWE-94
On CISA KEV	no
Public exploit	yes
Published	2006-06-23
Last modified	2026-06-16

Affected (1)

Vendor	Product
mcguestbook	mcguestbook

Public exploits

Source	Title	Date
exploit-db	mcGuestbook 1.3 - 'admin.php?lang' Remote File Inclusion	2006-06-16
exploit-db	mcGuestbook 1.3 - 'ecrire.php?lang' Remote File Inclusion	2006-06-16
exploit-db	mcGuestbook 1.3 - 'lire.php?lang' Remote File Inclusion	2006-06-16

References

→ the Explorer · watch your stack · NVD