CVE-2006-2842: High severity Squirrelmail Squirrelmail vulnerability
DISPUTED PHP remote file inclusion vulnerability in functions/plugin.php in SquirrelMail 1.4.6 and earlier, if registerglobals is enabled and magicquotesgpc is disabled, allows remote attackers to execute arbitrary PHP code via a URL in the plugins array parameter. NOTE: this issue has been disputed by third parties, who state that Squirrelmail provides prominent warnings to the administrator when registerglobals is enabled. Since the varieties of administrator negligence are uncountable, perhaps this type of issue should not be included in CVE. However, the original developer has posted a security advisory, so there might be relevant real-world environments under which this vulnerability is applicable.
Affected Software
Remediation
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2006-2842?
CVE-2006-2842 is considered a critical vulnerability due to its potential to allow remote attackers to execute arbitrary PHP code.
How can I fix CVE-2006-2842?
To mitigate CVE-2006-2842, disable the register_globals directive and enable magic_quotes_gpc in your PHP configuration.
Which versions of SquirrelMail are affected by CVE-2006-2842?
CVE-2006-2842 affects SquirrelMail versions 1.4.6 and earlier.
What type of vulnerability is CVE-2006-2842?
CVE-2006-2842 is a remote file inclusion vulnerability.
Can CVE-2006-2842 be exploited without any user interaction?
Yes, CVE-2006-2842 can be exploited remotely without requiring user interaction.