CVE-2006-3042: High severity ISPConfig ISPConfig vulnerability
DISPUTED Multiple PHP remote file inclusion vulnerabilities in ISPConfig 2.2.3 allow remote attackers to execute arbitrary PHP code via a URL in the (1) goinfo[isp][classesroot] parameter in (a) server.inc.php, and the (2) goinfo[server][classesroot] parameter in (b) app.inc.php, (c) login.php, and (d) trylogin.php. NOTE: this issue has been disputed by the vendor, who states that the original researcher "reviewed the installation tarball that is not identical with the resulting system after installtion. The file, where the $goinfo array is declared ... is created by the installer."
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2006-3042?
CVE-2006-3042 is considered high risk due to the potential for remote attackers to execute arbitrary PHP code.
How do I fix CVE-2006-3042?
To fix CVE-2006-3042, upgrade ISPConfig to the latest version or implement input validation to sanitize the affected parameters.
What versions of ISPConfig are affected by CVE-2006-3042?
CVE-2006-3042 specifically affects ISPConfig version 2.2.3.
What are the exploit vectors for CVE-2006-3042?
Attackers can exploit CVE-2006-3042 by manipulating the go_info[isp][classes_root] and go_info[server][classes_root] parameters.
Is CVE-2006-3042 still relevant today?
While CVE-2006-3042 is an older vulnerability, it can still pose a risk to unpatched systems using the affected ISPConfig version.