PT-2006-4490 · Phorum · Phorum

Published 2006-07-14 · Updated 2011-03-08 · CVE-2006-3615

Positive Technologies (AI Summary)

CVSS v2.0

5.1

Medium

Base vector

AV:N/AC:H/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Phorum version 5.1.14

Description The issue allows remote attackers to execute arbitrary PHP code via unspecified vectors related to an uninitialized variable when register globals is enabled.

Recommendations For Phorum version 5.1.14, disable the register globals setting to prevent exploitation. Consider upgrading to a version where this issue is fixed, if available. As a temporary workaround, consider restricting access to sensitive PHP files to minimize the risk of arbitrary code execution.

Fix

Related Identifiers

CVE-2006-3615

Affected Products

Phorum

References · 10

• https://nvd.nist.gov/vuln/detail/CVE-2006-3615 · Security Note
• http://osvdb.org/27164 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3615 · Note
• http://vupen.com/english/advisories/2006/2794 · Note
• http://archives.neohapsis.com/archives/bugtraq/2006-07/0200.html · Note
• http://archives.neohapsis.com/archives/bugtraq/2006-07/0191.html · Note
• http://phorum.org/phorum5/read.php?14%2C114358 · Note
• http://osvdb.org/27167 · Note
• http://retrogod.altervista.org/phorum5_local_incl_xpl.html · Note
• http://secunia.com/advisories/21043 · Note