CVE-2006-2516: Path Traversal
mainfile.php in XOOPS 2.0.13.2 and earlier, when registerglobals is enabled, allows remote attackers to overwrite variables such as $xoopsOption['nocommon'] and conduct directory traversal attacks or include PHP files via (1) xoopsConfig[language] to misc.php or (2) xoopsConfig[themeset] to index.php, as demonstrated by injecting PHP sequences into a log file.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2006-2516?
CVE-2006-2516 is rated as a high severity vulnerability due to potential remote code execution and directory traversal risks.
How do I fix CVE-2006-2516?
To mitigate CVE-2006-2516, it is recommended to disable register_globals in the PHP configuration and upgrade to a more secure version of XOOPS.
What versions of XOOPS are affected by CVE-2006-2516?
CVE-2006-2516 affects XOOPS versions 2.0.13.2 and earlier.
Can CVE-2006-2516 lead to data compromise?
Yes, CVE-2006-2516 can lead to unauthorized access to files and sensitive data due to directory traversal vulnerabilities.
Is there a patch available for CVE-2006-2516?
There is no specific patch for CVE-2006-2516; the recommended solution is to upgrade to a secure version of XOOPS.