Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

nvd логотип

CVE-2006-2516

Опубликовано: 22 мая 2006
Источник: nvd
CVSS2: 5.1
EPSS Низкий

Описание

mainfile.php in XOOPS 2.0.13.2 and earlier, when register_globals is enabled, allows remote attackers to overwrite variables such as $xoopsOption['nocommon'] and conduct directory traversal attacks or include PHP files via (1) xoopsConfig[language] to misc.php or (2) xoopsConfig[theme_set] to index.php, as demonstrated by injecting PHP sequences into a log file.

Ссылки

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:xoops:xoops:*:*:*:*:*:*:*:*
Версия до 2.0.13.2 (включая)
cpe:2.3:a:xoops:xoops:2.0:*:*:*:*:*:*:*
cpe:2.3:a:xoops:xoops:2.0.1:*:*:*:*:*:*:*
cpe:2.3:a:xoops:xoops:2.0.2:*:*:*:*:*:*:*
cpe:2.3:a:xoops:xoops:2.0.3:*:*:*:*:*:*:*
cpe:2.3:a:xoops:xoops:2.0.4:*:*:*:*:*:*:*
cpe:2.3:a:xoops:xoops:2.0.5:*:*:*:*:*:*:*
cpe:2.3:a:xoops:xoops:2.0.5.1:*:*:*:*:*:*:*
cpe:2.3:a:xoops:xoops:2.0.5.2:*:*:*:*:*:*:*
cpe:2.3:a:xoops:xoops:2.0.6:*:*:*:*:*:*:*
cpe:2.3:a:xoops:xoops:2.0.7:*:*:*:*:*:*:*
cpe:2.3:a:xoops:xoops:2.0.9:*:*:*:*:*:*:*
cpe:2.3:a:xoops:xoops:2.0.9.2:*:*:*:*:*:*:*
cpe:2.3:a:xoops:xoops:2.0.9.3:*:*:*:*:*:*:*
cpe:2.3:a:xoops:xoops:2.0.10:*:*:*:*:*:*:*
cpe:2.3:a:xoops:xoops:2.0.11:*:*:*:*:*:*:*
cpe:2.3:a:xoops:xoops:2.0.12_jp:*:*:*:*:*:*:*
cpe:2.3:a:xoops:xoops:2.0.13.1:*:*:*:*:*:*:*

EPSS

Процентиль: 90%
0.05235
Низкий

5.1 Medium

CVSS2

Дефекты

CWE-22

Связанные уязвимости

github логотип

GHSA-v8rp-8x66-vj5p

github
почти 4 года назад

mainfile.php in XOOPS 2.0.13.2 and earlier, when register_globals is enabled, allows remote attackers to overwrite variables such as $xoopsOption['nocommon'] and conduct directory traversal attacks or include PHP files via (1) xoopsConfig[language] to misc.php or (2) xoopsConfig[theme_set] to index.php, as demonstrated by injecting PHP sequences into a log file.

EPSS

Процентиль: 90%
0.05235
Низкий

5.1 Medium

CVSS2

Дефекты

CWE-22