CVE:CVE-2006-6225
CNNVD:CNNVD-200612-010
GeekLog存在多个PHP远程文件包含漏洞，远程攻击者可通过传给在plugins/目录下的(1)links/functions.inc，(2)polls/functions.inc，(3)spamx/BlackList.Examine.class.php，(4)spamx/DeleteComment.Action.class.php，(5)spamx/EditIPofURL.Admin.class.php，(6)spamx/MTBlackList.Examine.class.php，(7)spamx/MassDelete.Admin.class.php，(8)spamx/MailAdmin.Action.class.php，(9)spamx/MassDelTrackback.Admin.class.php，(10)spamx/EditHeader.Admin.class.php，(11)spamx/EditIP.Admin.class.php，(12)spamx/IPofUrl.Examine.class.php，(13)spamx/Import.Admin.class.php，(14)spamx/LogView.Admin.class.php和(15)staticpages/functions.inc的_CONF[path]参数内的URL来执行任意代码。
solution:Upgrade geeklog geeklog to a higher version than 1.4.0,1.4.0_beta1,1.4.0_sr1,1.4.0_sr2,1.4.0_sr3,1.4.0_sr4,and avoid the version 1.4.0,1.4.0_beta1,1.4.0_sr1,1.4.0_sr2,1.4.0_sr3,1.4.0_sr4