CVE-2006-1015: Medium severity PHP PHP vulnerability

Published Mar 7, 2006

Updated

Argument injection vulnerability in certain PHP 3.x, 4.x, and 5.x applications, when used with sendmail and when accepting remote input for the additionalparameters argument to the mail function, allows remote attackers to read and create arbitrary files via the sendmail -C and -X arguments. NOTE: it could be argued that this is a class of technology-specific vulnerability, instead of a particular instance; if so, then this should not be included in CVE.

Affected Software

75 affected components

PHP PHP=4.3.9

PHP PHP=3.0

PHP PHP=3.0.5

PHP PHP=3.0.11

PHP PHP=5.1.2

PHP PHP=4.2.0

PHP PHP=5.1.1

PHP PHP=3.0.1

PHP PHP=3.0.2

PHP PHP=5.0.0-beta1

PHP PHP=4.1.0

PHP PHP=4.3.4

PHP PHP=4.0.4

PHP PHP=4.3.0

PHP PHP=4.0.5

PHP PHP=5.0-rc1

PHP PHP=3.0.8

PHP PHP=5.0.5

PHP PHP=4.3.6

PHP PHP=3.0.13

PHP PHP=5.0.1

PHP PHP=4.0.7-rc2

PHP PHP=4.3.7

PHP PHP=5.0.4

PHP PHP=4.0.7-rc1

PHP PHP=4.2.2

PHP PHP=4.4.2

PHP PHP=3.0.7

PHP PHP=4.3.2

PHP PHP=4.3.11

PHP PHP=4.0.0

PHP PHP=3.0.6

PHP PHP=4.0.3-patch1

PHP PHP=3.0.17

PHP PHP=4.0.7

PHP PHP=4.0.2

PHP PHP=4.3.3

PHP PHP=5.0-rc3

PHP PHP=4.1.1

PHP PHP=3.0.15

PHP PHP=3.0.16

PHP PHP=5.0.0-rc2

PHP PHP=5.0.3

PHP PHP=3.0.10

PHP PHP=3.0.4

PHP PHP=4.2.3

PHP PHP=5.1.0

PHP PHP=4.0.1-patch1

PHP PHP=5.0.0-rc3

PHP PHP=4.0.1-patch2

PHP PHP=4.0.6

PHP PHP=5.0-rc2

PHP PHP=4.1.2

PHP PHP=5.0.0-beta3

PHP PHP=4.0.7-rc3

PHP PHP=4.3.1

PHP PHP=3.0.18

PHP PHP=4.4.0

PHP PHP=4.3.10

PHP PHP=4.2.1

PHP PHP=5.0.0-rc1

PHP PHP=4.0.1

PHP PHP=5.0.2

PHP PHP=3.0.12

PHP PHP=4.2

PHP PHP=4.4.1

PHP PHP=4.0.3

PHP PHP=3.0.14

PHP PHP=3.0.9

PHP PHP=3.0.3

PHP PHP=5.0.0-beta4

PHP PHP=5.0.0

PHP PHP=4.3.8

PHP PHP=4.3.5

PHP PHP=5.0.0-beta2

Event History

Mar 7, 2006

CVE Published

12:02 AM

CVE Published

via MITRE·05:00 AM

Data Sourced

via MITRE·05:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2006-1015?

CVE-2006-1015 is classified as a high-severity vulnerability due to its potential to allow remote attackers to execute arbitrary file operations.

How do I fix CVE-2006-1015?

To mitigate CVE-2006-1015, it is recommended to upgrade to a newer version of PHP that addresses this vulnerability.

What applications are affected by CVE-2006-1015?

CVE-2006-1015 impacts specific versions of PHP 3.x, 4.x, and 5.x that are configured to use the mail function with sendmail.

Can CVE-2006-1015 lead to data breaches?

Yes, CVE-2006-1015 can potentially lead to data breaches as it allows unauthorized access to read and create files.

Is CVE-2006-1015 still relevant today?

While CVE-2006-1015 was disclosed in 2006, its relevance persists for legacy systems that still use vulnerable PHP versions.