Multiple PHP remote file include vulnerabilities in dotProject 2.0.1 and earlier, when…
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- High
- Impact type
- —
- Confidentiality · integrity · availability
- Low · Low · Low
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA.
Summary
Multiple PHP remote file include vulnerabilities in dotProject 2.0.1 and earlier, when register_globals is enabled, allow remote attackers to execute arbitrary commands via the baseDir parameter in (1) db_adodb.php, (2) db_connect.php, (3) session.php, (4) vw_usr_roles.php, (5) calendar.php, (6) date_format.php, and (7) tasks/gantt.php; and the dPconfig[root_dir] parameter in (8) projects/gantt.php, (9) gantt2.php, and (10) vw_files.php. NOTE: the vendor disputes this issue, stating that the product documentation clearly recommends that the system administrator disable register_globals, and that the check.php script warns against this setting. Also, the vendor says that the protection.php/siteurl vector is incorrect because protection.php does not exist in the product
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
CPE configurations NVD · 2
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:dotproject:dotproject:2.0:*:*:*:*:*:*:* | 2.0 | Vulnerable | Dotproject |
| cpe:2.3:a:dotproject:dotproject:2.0.1:*:*:*:*:*:*:* | 2.0.1 | Vulnerable | Dotproject |
- cpe:2.3:a:dotproject:dotproject:2.0:*:*:*:*:*:*:* Versions 2.0 Vulnerable ·Dotproject
- cpe:2.3:a:dotproject:dotproject:2.0.1:*:*:*:*:*:*:* Versions 2.0.1 Vulnerable ·Dotproject
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2006-0755
- 2026-10-03 Alias added: GHSA-7x4q-26xj-gjr7
More Dotproject vulnerabilities
- TI-2002-01350 index.php in dotProject 0.2.1.5 allows remote attackers to bypass authentication via a… CVSS 2.0HIGH 10.0
- TI-2006-04089 PHP remote file inclusion vulnerability in classes/query.class.php in dotProject 2.0.4… CVSS 2.0HIGH 7.5
- TI-2008-06436 dotProject before 2.1.2 does not properly restrict access to administrative pages, which… CVSS 2.0MEDIUM 6.8
- TI-2012-04798 Multiple SQL injection vulnerabilities in dotProject before 2.1.7 allow remote… CVSS 2.0MEDIUM 6.8
- TI-2007-05272 dotProject before 2.1 does not properly check privileges when invoking the Companies… CVSS 2.0MEDIUM 6.4
- TI-2008-03726 Multiple SQL injection vulnerabilities in index.php in dotProject 2.1.2 allow (1) remote… CVSS 2.0MEDIUM 6.0
Sources
- CVE-2006-0755 · CVE Program
- CVE-2006-0755 · NVD
- FIRST EPSS
- GHSA-7x4q-26xj-gjr7 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences