CVE-2006-3615: Medium severity Phorum Phorum vulnerability

Published Jul 14, 2006

Updated

Multiple PHP remote file inclusion vulnerabilities in Phorum 5.1.14, when registerglobals is enabled, allow remote attackers to execute arbitrary PHP code via unspecified vectors related to an uninitialized variable.

Affected Software

1 affected component

Phorum Phorum=5.1.14

Remediation

Patch Available

http://www.phorum.org/phorum5/read.php?14,114358

Event History

Jul 14, 2006

CVE Published

via MITRE·09:00 PM

Data Sourced

via MITRE·09:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2006-3615?

CVE-2006-3615 is considered a critical vulnerability due to its ability to allow remote attackers to execute arbitrary PHP code.

How do I fix CVE-2006-3615?

The vulnerability can be mitigated by disabling register_globals in the PHP configuration and upgrading to a patched version of Phorum.

Which versions of Phorum are affected by CVE-2006-3615?

CVE-2006-3615 specifically affects Phorum version 5.1.14.

What type of attack can exploit CVE-2006-3615?

CVE-2006-3615 can be exploited through remote file inclusion attacks thanks to uninitialized variables.

Who is affected by CVE-2006-3615?

Any users or administrators running Phorum 5.1.14 with register_globals enabled are at risk from CVE-2006-3615.