CVE:CVE-2006-2864
CNNVD:CNNVD-200606-130
BlueShoes Framework 4.6存在多个PHP远程文件包含漏洞，远程攻击者可通过在传给(a) Bs_Faq.class.php的(1)APP[path][applications]参数，传给(b)fileBrowserInner.php，(c)file.php和(d)viewer.php和(e)Bs_ImageArchive.class.php的(2)APP[path][core]参数，传给(f)Bs_Ml_User.class.php的(3)GLOBALS[APP][path][core]参数或者传给(g) Bs_Wse_Profile.class.php的(4)APP[path][plugins]参数中的URL来执行任意PHP代码。
solution:Upgrade blueshoes blueshoes_framework to a higher version than 4.6,4.5,and avoid the version (,4.6],4.5