CVE:CVE-2006-4533
CNNVD:CNNVD-200609-011
Plume CMS 1.0.6及更早版本中的多个PHP远程文件包含漏洞，远程攻击者可以通过以下文件中的_PX_config[manager_path]参数执行任意PHP代码：(1) articles.php, (2) categories.php, (3) news.php, (4) prefs.php, (5) sites.php, (6) subtypes.php, (7) users.php, (8) xmedia.php, (9) frontinc/class.template.php, (10) inc/lib.text.php, (11) install/index.php, (12) install/upgrade.php和(13) tools/htaccess/index.php。
solution:Upgrade plume-cms plume_cms to a higher version than 1.0.6,1.0.5,and avoid the version (,1.0.6],1.0.5