CVE-2006-2158 | BDVDB-2026-16674 Detail

Description#

Dynamic variable evaluation vulnerability in index.php in Stadtaus Guestbook Script 1.7 and earlier, when register_globals is enabled, allows remote attackers to modify arbitrary program variables via parameters, which are evaluated as PHP variable variables, as demonstrated by performing PHP remote file inclusion using the include_files array parameter.

Impact#

No impact statement in the source data.

Weaknesses#

No weakness recorded in the source data.

References#

http://secunia.com/advisories/19957
http://www.securityfocus.com/bid/17845
https://exchange.xforce.ibmcloud.com/vulnerabilities/26252
http://retrogod.altervista.org/gbs_17_xpl_pl.html
http://www.stadtaus.com/forum/t-2600.html
http://www.vupen.com/english/advisories/2006/1660

Exploit#

No public exploit known

History#

Version 12006-05-03Record published in the CVE List.
Version 22024-08-07Most recent update recorded in the CVE List.