CVE-2006-2516

mainfile.php in XOOPS 2.0.13.2 and earlier, when register_globals is enabled, allows remote attackers to overwrite variables such as $xoopsOption['nocommon']…

published May 22, 2006

CVSS
—
EPSS
6%
Percentile
93.6
In the wild
Unconfirmed
What it is

mainfile.php in XOOPS 2.0.13.2 and earlier, when register_globals is enabled, allows remote attackers to overwrite variables such as $xoopsOption['nocommon'] and conduct directory traversal attacks or include PHP files via (1) xoopsConfig[language] to misc.php or (2) xoopsConfig[theme_set] to index.php, as demonstrated by injecting PHP sequences into a log file.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.06351 · 93.6th percentile
Published
2006-05-22T22:00Z
EPSS history
Timeline
  • 22 MAY 22:00Z
    mainfile.php in XOOPS 2.0.13.2 and earlier, when register_globals is enabled, allows remote attackers to overwrite variables such as $xoopsOption['nocommon']…
    cvelistv5