CVE-2006-5085: Blog Pixel Motion config.php static code injection enables PHP execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: medium.

high priorityUnauthenticated remote code execution with public exploit references and very high EPSS, though no KEV listing or confirmed active exploitation.

What it is

Blog Pixel Motion 2.1.1 writes the nom_blog parameter from config.php into include/variables.php without sanitization, allowing injected PHP code to be stored and later executed. Because the injected code lands in an included file, the flaw gives persistent code execution on the web server rather than a one-off request effect.

Impact

An attacker can execute arbitrary PHP code in the context of the web server, leading to full compromise of the application and potentially the host. The CVSS 2.0 vector shows partial confidentiality, integrity and availability impact.

Attack surface

Reachable over the network through config.php with no authentication required (AV:N/AC:L/Au:N). No user interaction is indicated by the vector or description.

Exploitation

Public exploit references are tagged Exploit, and EPSS is 0.47295 (98.8th percentile), indicating elevated likelihood; the CVE is not listed in CISA KEV, so no confirmed in-the-wild exploitation is recorded.

What to do

• Upgrade or patch Blog Pixel Motion beyond 2.1.1 if a fixed release exists; the record does not name a patched version.
• If no patch is available, remove or restrict access to config.php and the installation directory.
• Sanitize and validate the nom_blog parameter before it is written into include/variables.php.
• Make include/variables.php and the include directory non-writable by the web server process.
• Run the application under a least-privilege account and disable risky PHP functions where feasible.

Detection

• Monitor writes to include/variables.php and alert on PHP code appearing in that file.
• Review web logs for requests to config.php with unusual nom_blog values containing PHP tags or function calls.
• Scan the web root for unexpected PHP content in configuration or include files.
• Check for outbound or child processes spawned by the web server that suggest injected code execution.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.