Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2006-2516

mainfile.php in XOOPS 2.0.13.2 and earlier, when register_globals is enabled, allows remote attackers to overwrite variables such as $xoopsOption['nocommon'] and conduct directory traversal attacks or include PHP files via (1) xoopsConfig[language] to misc.php or (2) xoopsConfig[theme_set] to index.php, as demonstrated by injecting PHP sequences into a log file.

Published

2006-05-22T22:02:00.000

Last Modified

2025-04-03T01:03:51.193

Status

Deferred

Source

[email protected]

Severity

CVSSv2: 5.1 (MEDIUM)

CVSSv2 Vector

AV:N/AC:H/Au:N/C:P/I:P/A:P

  • Access Vector: NETWORK
  • Access Complexity: HIGH
  • Authentication: NONE
  • Confidentiality Impact: PARTIAL
  • Integrity Impact: PARTIAL
  • Availability Impact: PARTIAL
Exploitability Score

4.9

Impact Score

6.4

Weaknesses
  • Type: Primary
    CWE-22
Affected Vendors & Products
Type Vendor Product Version/Range Vulnerable?
Application xoops xoops ≤ 2.0.13.2 Yes
Application xoops xoops 2.0 Yes
Application xoops xoops 2.0.1 Yes
Application xoops xoops 2.0.2 Yes
Application xoops xoops 2.0.3 Yes
Application xoops xoops 2.0.4 Yes
Application xoops xoops 2.0.5 Yes
Application xoops xoops 2.0.5.1 Yes
Application xoops xoops 2.0.5.2 Yes
Application xoops xoops 2.0.6 Yes
Application xoops xoops 2.0.7 Yes
Application xoops xoops 2.0.9 Yes
Application xoops xoops 2.0.9.2 Yes
Application xoops xoops 2.0.9.3 Yes
Application xoops xoops 2.0.10 Yes
Application xoops xoops 2.0.11 Yes
Application xoops xoops 2.0.12_jp Yes
Application xoops xoops 2.0.13.1 Yes
References