CVE-2006-6511

Severity: medium (CVSS 6.8 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2006-12-14 · updated 2026-06-16

Description

dadaIMC .99.3 uses an insufficiently restrictive FilesMatch directive in the installed .htaccess file, which allows remote attackers to execute arbitrary PHP code by uploading files whose names contain (1) feature, (2) editor, (3) newswire, (4) otherpress, (5) admin, (6) pbook, (7) media, or (8) mod, which are processed as PHP file types (application/x-httpd-php).

Affected products

Dadaimc: through 0.99.3

References

http://bugs.dadaimc.org/view.php?id=191
http://secunia.com/advisories/23305
http://www.vupen.com/english/advisories/2006/4977
https://exchange.xforce.ibmcloud.com/vulnerabilities/30862
http://bugs.dadaimc.org/view.php?id=191
http://secunia.com/advisories/23305
http://www.vupen.com/english/advisories/2006/4977
https://exchange.xforce.ibmcloud.com/vulnerabilities/30862

Get alerted when CVE-2006-6511 or the next vulnerability affects your stack