← Database

CVE-2008-6171

CRITICAL CVSS: 9.3 Published: 2009-02-19 Modified: 2026-06-16

Description

includes/bootstrap.inc in Drupal 5.x before 5.12 and 6.x before 6.6, when the server is configured for "IP-based virtual hosts," allows remote attackers to include and execute arbitrary files via the HTTP Host header.

Affected Platforms

Drupal Drupal

Weakness Type

CWE-16, CWE-20

References