Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
6.4

PHP Blue Dragon Platinum runs code from crafted URL

CVE-2006-2392 · published 20 years ago
Summary

The 2.8.0 version of PHP Blue Dragon Platinum lets an attacker supply a specially crafted web address in the vsDragonRootPath field, causing the system to load and run that external code. This can give a remote attacker full control of the server. Apply the vendor's update or patch and restrict the ability to pass URLs in that parameter.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
blue_dragon php_blue_dragon platinum_2.8.0
cpe:2.3:a:blue_dragon:php_blue_dragon:platinum_2.8.0:*:*:*:*:*:*:*
Original advisory text
PHP remote file inclusion vulnerability in public_includes/pub_popup/popup_finduser.php in PHP Blue Dragon Platinum 2.8.0 allows remote attackers to execute arbitrary PHP code via a URL in the vsDr...
PHP remote file inclusion vulnerability in public_includes/pub_popup/popup_finduser.php in PHP Blue Dragon Platinum 2.8.0 allows remote attackers to execute arbitrary PHP code via a URL in the vsDragonRootPath parameter.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker partial control (estimated)
Severity
6.4 Medium
Exploitation
8% chance of attack within 30 days
Timeline
Published16 May 2006
Updated2 Nov 2026
First seen29 Sep 2026
Sources
CVE-2006-2392 · NVD
Track software like this
Free during beta