Description
includes/bootstrap.inc in Drupal 5.x before 5.12 and 6.x before 6.6, when the server is configured for "IP-based virtual hosts," allows remote attackers to include and execute arbitrary files via the HTTP Host header.
Remediation
References
Related Vulnerabilities
WordPress Plugin TextMe SMS Cross-Site Scripting (1.8.8)
Liferay Portal Cross-Site Request Forgery (CSRF) Vulnerability (CVE-2024-26273)
PHP Improper Access Control Vulnerability (CVE-2016-5385)
WordPress Plugin Dtracker Multiple Vulnerabilities (1.5)
Oracle Application Server CVE-2008-3987 Vulnerability (CVE-2008-3987)