CVE-2006-2685: BASE PHP remote file inclusion via BASE_path parameter

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: high.

high priorityUnauthenticated remote code execution with public exploit code and high EPSS, though exploitation requires register_globals to be enabled.

What it is

Basic Analysis and Security Engine (BASE) 1.2.4 and earlier allows remote file inclusion through the BASE_path parameter in base_qry_common.php, base_stat_common.php, and includes/base_include.inc.php when register_globals is enabled. An attacker can point BASE_path at a remote file and cause arbitrary PHP code to execute. The flaw matters because it gives unauthenticated remote code execution on a web application that is often exposed to the internet.

Impact

An attacker gains arbitrary PHP code execution in the context of the web server, which can lead to full compromise of the BASE host and any data it can reach.

Attack surface

Reachable over the network through HTTP requests to the affected PHP scripts; no authentication is required, and no user interaction is needed. Exploitation depends on the PHP register_globals setting being enabled.

Exploitation

Not listed in CISA KEV, but EPSS is high at roughly 0.49 (98.8th percentile) and references include an Exploit tag and an Exploit-DB entry, indicating public exploit code exists.

What to do

• Upgrade BASE to a version later than 1.2.4 or apply the vendor patch referenced in the SecurityFocus advisory.
• Disable register_globals in PHP configuration, which removes the precondition for this vulnerability.
• Restrict outbound network access from the web server so it cannot fetch remote files used in inclusion attacks.
• If BASE cannot be patched immediately, remove or block access to the affected scripts from untrusted networks.
• Run the web application with least privilege and keep PHP and the web server patched.

Detection

• Search web server logs for requests to base_qry_common.php, base_stat_common.php, or includes/base_include.inc.php containing a BASE_path parameter with an external URL.
• Monitor for outbound HTTP requests from the web server to unfamiliar hosts, which may indicate remote file inclusion.
• Look for unexpected PHP files or modified content in the BASE web directory that could indicate dropped payloads.
• Alert on PHP errors or warnings referencing include or require with remote URLs in application logs.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.