CVE-2006-2842

PHP remote file inclusion vulnerability in functions/plugin.php in SquirrelMail 1.4.6 and earlier, if register_globals is enabled and magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary PHP code via a URL in the plugins array parameter. NOTE: this issue has been disputed by third parties, who state that Squirrelmail provides prominent warnings to the administrator when register_globals is enabled. Since the varieties of administrator negligence are uncountable, perhaps this type of issue should not be included in CVE. However, the original developer has posted a security advisory, so there might be relevant real-world environments under which this vulnerability is applicable

CVSS v2.0

7.5 HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P

EPSS

47.20% chance of exploitation in the next 30 days, 99th percentile

Nuclei

high · CWE-22

Published

2006-06-06

Updated

2024-08-07

Proof-of-concept exploits (1)

• karthi-the-hacker/CVE-2006-28423★ · 2023-12-28

Nuclei templates (1)

• projectdiscovery/nuclei-templates/blob/main/http/cves/2006/CVE-2006-2842.yaml

ExploitDB entries (1)

• https://www.exploit-db.com/exploits/27948

References

• CVE Record
• NVD entry

Related

• CVE-2020-17453
• CVE-2021-31589
• CVE-2023-27524
• CVE-2006-2841
• CVE-2006-2843
• CVE-2006-2835