Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.5

Socketwiz Bookmarks remote file inclusion via root_dir

CVE-2006-7069 · published 19 years ago
Summary

The Socketwiz Bookmarks product (version 2.0 and earlier) lets an attacker supply a crafted root_dir value that causes the server to load and run code from an external location. This can let a malicious party run any script on your web server, potentially stealing data or disrupting services. Apply the vendor’s update or patch, and ensure input validation is in place to block such requests.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
socketwiz bookmarks <= 2.0
cpe:2.3:a:socketwiz:bookmarks:*:*:*:*:*:*:*:*
Original advisory text
PHP remote file inclusion vulnerability in smarty_config.php in Socketwiz Bookmarks 2.0 and earlier allows remote attackers to execute arbitrary PHP code via the root_dir parameter.
PHP remote file inclusion vulnerability in smarty_config.php in Socketwiz Bookmarks 2.0 and earlier allows remote attackers to execute arbitrary PHP code via the root_dir parameter.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker partial control (estimated)
Severity
7.5 High
Exploitation
3% chance of attack within 30 days
Timeline
Published2 Mar 2007
Updated30 Oct 2026
First seen29 Sep 2026
Sources
CVE-2006-7069 · NVD
Track software like this
Free during beta