CVE-2006-2828: Medium severity PHP-Nuke Ev vulnerability
Global variable overwrite vulnerability in PHP-Nuke allows remote attackers to conduct remote PHP file inclusion attacks via a modified phpbbrootpath parameter to the admin scripts (1) index.php, (2) adminugauth.php, (3) adminboard.php, (4) admindisallow.php, (5) adminforumauth.php, (6) admingroups.php, (7) adminranks.php, (8) adminstyles.php, (9) adminuserban.php, (10) adminwords.php, (11) adminavatar.php, (12) admindbutilities.php, (13) adminforumprune.php, (14) adminforums.php, (15) adminmassemail.php, (16) adminsmilies.php, (17) adminugauth.php, and (18) adminusers.php, which overwrites $phpbbrootpath when the importrequestvariables function is executed after $phpbbrootpath has been initialized to a static value.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2006-2828?
CVE-2006-2828 is classified as a high severity vulnerability due to its potential for remote PHP file inclusion attacks.
How do I fix CVE-2006-2828?
To fix CVE-2006-2828, update PHP-Nuke to the latest version that addresses this vulnerability.
What software is affected by CVE-2006-2828?
CVE-2006-2828 affects PHP-Nuke Evolution versions that allow manipulation of the phpbb_root_path parameter.
What type of attack does CVE-2006-2828 enable?
CVE-2006-2828 enables remote attackers to conduct remote PHP file inclusion attacks.
Who can exploit CVE-2006-2828?
Remote attackers can exploit CVE-2006-2828 if they manipulate the phpbb_root_path parameter in specific admin scripts.