Published: 06/06/2006 Updated: 11/04/2024

CVSS v2 Base Score: 7.5 | Impact Score: 6.4 | Exploitability Score: 10

VMScore: 755

Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P

PHP remote file inclusion vulnerability in functions/plugin.php in SquirrelMail 1.4.6 and previous versions, if register_globals is enabled and magic_quotes_gpc is disabled, allows remote malicious users to execute arbitrary PHP code via a URL in the plugins array parameter. NOTE: this issue has been disputed by third parties, who state that Squirrelmail provides prominent warnings to the administrator when register_globals is enabled. Since the varieties of administrator negligence are uncountable, perhaps this type of issue should not be included in CVE. However, the original developer has posted a security advisory, so there might be relevant real-world environments under which this vulnerability is applicable

Vulnerable Product	Search on Vulmon	Subscribe to Product
squirrelmail squirrelmail 1.4.2
squirrelmail squirrelmail 1.0.5
squirrelmail squirrelmail 1.4.6_rc1
squirrelmail squirrelmail 1.4.3_r3
squirrelmail squirrelmail 1.2.7
squirrelmail squirrelmail 1.2.0
squirrelmail squirrelmail 1.2.9
squirrelmail squirrelmail 1.4.3_rc1
squirrelmail squirrelmail 1.2.2
squirrelmail squirrelmail 1.4.4_rc1
squirrelmail squirrelmail 1.4.3
squirrelmail squirrelmail 1.2.1
squirrelmail squirrelmail 1.4.1
squirrelmail squirrelmail 1.4.0
squirrelmail squirrelmail 1.4
squirrelmail squirrelmail 1.2.4
squirrelmail squirrelmail 1.2.3
squirrelmail squirrelmail 1.4.3a
squirrelmail squirrelmail
squirrelmail squirrelmail 1.0.4
squirrelmail squirrelmail 1.2.6
squirrelmail squirrelmail 1.4.4
squirrelmail squirrelmail 1.2.10
squirrelmail squirrelmail 1.2.5
squirrelmail squirrelmail 1.2.8
squirrelmail squirrelmail 1.2.11
squirrelmail squirrelmail 1.4.5

Debian Bug report logs - #373731 squirrelmail redirectphp local file include vulnerability Package: squirrelmail; Maintainer for squirrelmail is Jeroen van Wolffelaar <jeroen@wolffelaarnl>; Source for squirrelmail is src:squirrelmail (PTS, buildd, popcon) Reported by: Oliver Paulus <oliver@code-projectorg> Date: T ...

Debian Bug report logs - #375782 squirrelmail: CVE-2006-3174: cross-site scripting in searchphp when register_globals is on Package: squirrelmail; Maintainer for squirrelmail is Jeroen van Wolffelaar <jeroen@wolffelaarnl>; Source for squirrelmail is src:squirrelmail (PTS, buildd, popcon) Reported by: Alec Berryman <alec ...

source: wwwsecurityfocuscom/bid/18231/info SquirrelMail is prone to a local file-include vulnerability because it fails to properly sanitize user-supplied input A successful exploit may allow unauthorized users to view files and to execute local scripts; other attacks are also possible wwwexamplecom/[squirrelmail dir]/src/red ...

CVE-2006-2842 is a powerful scanner for bug bounty hunters and penetration testers to discover vulnerabilities in their web applications.

Badges License MIT Installation Install cve-2006-2842 with npm npm install cve-2006-2842 -g Usage Example for single url cve-2006-2842 -u examplecom Usage Example for list of urls cve-2006-2842 -l urlstxt -o outtxt Screenshots Help menu Get al

NVD-CWE-Other http://squirrelmail.cvs.sourceforge.net/squirrelmail/squirrelmail/functions/global.php?r1=1.27.2.16&r2=1.27.2.17&view=patch&pathrev=SM-1_4-STABLE http://www.squirrelmail.org/security/issue/2006-06-01 http://secunia.com/advisories/20406 http://www.securityfocus.com/bid/18231 http://securitytracker.com/id?1016209 http://www.redhat.com/support/errata/RHSA-2006-0547.html http://secunia.com/advisories/20931 http://www.novell.com/linux/security/advisories/2006_17_sr.html http://secunia.com/advisories/21159 ftp://patches.sgi.com/support/free/security/advisories/20060703-01-U.asc http://secunia.com/advisories/21262 http://docs.info.apple.com/article.html?artnum=306172 http://lists.apple.com/archives/security-announce//2007/Jul/msg00004.html http://www.mandriva.com/security/advisories?name=MDKSA-2006:101 http://www.securityfocus.com/bid/25159 http://secunia.com/advisories/26235 http://www.vupen.com/english/advisories/2007/2732 http://www.vupen.com/english/advisories/2006/2101 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11670 http://www.securityfocus.com/archive/1/435605/100/0/threaded https://nvd.nist.gov https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=373731 https://github.com/karthi-the-hacker/CVE-2006-2842 https://www.exploit-db.com/exploits/27948/

CVE-2006-2842

Vulnerability Summary

Vendor Advisories

Exploits

Github Repositories

References

Vulmon Search

About

Products

Connect