GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

FKIE_CVE-2006-5630

Vulnerability from fkie_nvd - Published: 2006-10-31 22:07 - Updated: 2026-06-16 22:31
Severity
Summary
Hosting Controller 6.1 before Hotfix 3.3 allows remote attackers to (1) delete the virtual directory of an arbitrary site via a modified ForumID parameter in a disableforum action in DisableForum.asp and (2) create an arbitrary forum virtual directory via an empty ForumID parameter in an enableforum action in EnableForum.asp.
References
cve@mitre.orghttp://secunia.com/advisories/22607
cve@mitre.orghttp://securityreason.com/securityalert/1804
cve@mitre.orghttp://securitytracker.com/id?1017103Exploit, Patch
cve@mitre.orghttp://www.kapda.ir/advisory-442.htmlExploit, Patch
cve@mitre.orghttp://www.securityfocus.com/archive/1/449937/100/0/threaded
cve@mitre.orghttp://www.vupen.com/english/advisories/2006/4296
af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/22607
af854a3a-2127-422b-91ae-364da2661108http://securityreason.com/securityalert/1804
af854a3a-2127-422b-91ae-364da2661108http://securitytracker.com/id?1017103Exploit, Patch
af854a3a-2127-422b-91ae-364da2661108http://www.kapda.ir/advisory-442.htmlExploit, Patch
af854a3a-2127-422b-91ae-364da2661108http://www.securityfocus.com/archive/1/449937/100/0/threaded
af854a3a-2127-422b-91ae-364da2661108http://www.vupen.com/english/advisories/2006/4296
Impacted products
Vendor Product Version
hosting_controller hosting_controller *
hosting_controller hosting_controller 1.1
hosting_controller hosting_controller 1.3
hosting_controller hosting_controller 1.4
hosting_controller hosting_controller 1.4.1
hosting_controller hosting_controller 1.4b
hosting_controller hosting_controller 6.1
hosting_controller hosting_controller 6.1_hotfix_1.4
hosting_controller hosting_controller 6.1_hotfix_1.7
hosting_controller hosting_controller 6.1_hotfix_1.9
hosting_controller hosting_controller 6.1_hotfix_2.0
hosting_controller hosting_controller 6.1_hotfix_2.1
hosting_controller hosting_controller 6.1_hotfix_2.2
hosting_controller hosting_controller 6.1_hotfix_2.3
hosting_controller hosting_controller 6.1_hotfix_2.4
hosting_controller hosting_controller 6.1_hotfix_3.1
hosting_controller hosting_controller 2002
hosting_controller hosting_controller 2002_rc_1
To clipboard 

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "source": "cve@mitre.org"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:hosting_controller:hosting_controller:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "FD0B34AC-0C2D-4E17-AC72-4BDF1769F54D",
              "versionEndIncluding": "6.1_hotfix_3.2",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:hosting_controller:hosting_controller:1.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "94170D21-1196-4BA2-AEB9-C28A4F08B05D",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:hosting_controller:hosting_controller:1.3:*:*:*:*:*:*:*",
              "matchCriteriaId": "3364FE23-345B-428B-BF18-A0AE4D23B03B",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:hosting_controller:hosting_controller:1.4:*:*:*:*:*:*:*",
              "matchCriteriaId": "CDDE2038-F5C8-49A9-86D6-E94DA2A93016",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:hosting_controller:hosting_controller:1.4.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "64E9E17B-92A3-434F-B238-8B403BE4F539",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:hosting_controller:hosting_controller:1.4b:*:*:*:*:*:*:*",
              "matchCriteriaId": "1220294A-27FC-4D1C-BFA8-2B7189E04469",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:hosting_controller:hosting_controller:6.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "7BD6BB80-8513-4294-8A81-FE8B11FA8BF0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:hosting_controller:hosting_controller:6.1_hotfix_1.4:*:*:*:*:*:*:*",
              "matchCriteriaId": "A8DDFC8A-C341-4137-AF44-F93E814E218B",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:hosting_controller:hosting_controller:6.1_hotfix_1.7:*:*:*:*:*:*:*",
              "matchCriteriaId": "8BDE7F42-4372-440E-9E8A-D4B123EB9045",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:hosting_controller:hosting_controller:6.1_hotfix_1.9:*:*:*:*:*:*:*",
              "matchCriteriaId": "03E517F5-FA8C-4099-9D2C-6818A3082881",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:hosting_controller:hosting_controller:6.1_hotfix_2.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "ABC9B48D-8D14-40D1-A444-2EC2661E40A2",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:hosting_controller:hosting_controller:6.1_hotfix_2.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "52010E43-81DA-4E60-8CE9-7E60DC017DA0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:hosting_controller:hosting_controller:6.1_hotfix_2.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "2DBFE7C3-7F21-4F63-9EB1-42C33E93B702",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:hosting_controller:hosting_controller:6.1_hotfix_2.3:*:*:*:*:*:*:*",
              "matchCriteriaId": "7BAAEE0D-CDCE-46F2-8FCD-E9C9CD7BB159",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:hosting_controller:hosting_controller:6.1_hotfix_2.4:*:*:*:*:*:*:*",
              "matchCriteriaId": "E051F8D0-46E1-4609-9C39-BE2BBD291DBC",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:hosting_controller:hosting_controller:6.1_hotfix_3.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "8C2F192C-B59F-4EA7-9399-D1AF7F233058",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:hosting_controller:hosting_controller:2002:*:*:*:*:*:*:*",
              "matchCriteriaId": "A7F80268-2491-4900-ABEB-9DDBC9E54DB9",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:hosting_controller:hosting_controller:2002_rc_1:*:*:*:*:*:*:*",
              "matchCriteriaId": "8BABF84D-F609-429E-9C77-7C251F23AB31",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Hosting Controller 6.1 before Hotfix 3.3 allows remote attackers to (1) delete the virtual directory of an arbitrary site via a modified ForumID parameter in a disableforum action in DisableForum.asp and (2) create an arbitrary forum virtual directory via an empty ForumID parameter in an enableforum action in EnableForum.asp."
    },
    {
      "lang": "es",
      "value": "Hosting Controller 6.1 versiones anteriores a Hotfix 3.3 permite a atacantes remotos (1) borrar el directorio virtual de un sitio de su elecci\u00f3n mediante el p\u00e1rametro modificado ForumID en una acci\u00f3n \"deshabilita foro\" en DisableForum.asp y (2) crear un directorio virtual de foro de su elecci\u00f3n mediante un par\u00e1emtro vac\u00edo ForumID en una acci\u00f3n \"habilita foro\" en EnableForum.asp"
    }
  ],
  "evaluatorSolution": "This vulnerability is addressed in the following product update:\r\nHosting Controller, Hosting Controller, 6.1 Hotfix 3.3",
  "id": "CVE-2006-5630",
  "lastModified": "2026-06-16T22:31:34.197",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "HIGH",
        "cvssData": {
          "accessComplexity": "LOW",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "PARTIAL",
          "baseScore": 7.5,
          "confidentialityImpact": "PARTIAL",
          "integrityImpact": "PARTIAL",
          "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
          "version": "2.0"
        },
        "exploitabilityScore": 10.0,
        "impactScore": 6.4,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": true,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ]
  },
  "published": "2006-10-31T22:07:00.000",
  "references": [
    {
      "source": "cve@mitre.org",
      "url": "http://secunia.com/advisories/22607"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://securityreason.com/securityalert/1804"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Exploit",
        "Patch"
      ],
      "url": "http://securitytracker.com/id?1017103"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Exploit",
        "Patch"
      ],
      "url": "http://www.kapda.ir/advisory-442.html"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.securityfocus.com/archive/1/449937/100/0/threaded"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.vupen.com/english/advisories/2006/4296"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://secunia.com/advisories/22607"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://securityreason.com/securityalert/1804"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Exploit",
        "Patch"
      ],
      "url": "http://securitytracker.com/id?1017103"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Exploit",
        "Patch"
      ],
      "url": "http://www.kapda.ir/advisory-442.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.securityfocus.com/archive/1/449937/100/0/threaded"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.vupen.com/english/advisories/2006/4296"
    }
  ],
  "sourceIdentifier": "cve@mitre.org",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-Other"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.