CVE-2006-4215: Code Injection
Published Aug 17, 2006
·Updated
PHP remote file inclusion vulnerability in index.php in Zen Cart 1.3.0.2 and earlier, when registerglobals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the autoLoadConfig[999][0][loadFile] parameter.
Affected Software
1 affected component
Zen Cart Zen Cart<=1.3.0.2
Event History
Aug 17, 2006
CVE Published
09:04 PM
Aug 18, 2006
CVE Published
via MITRE·01:00 AM
Data Sourced
via MITRE·01:00 AM
Description
Frequently Asked Questions
1
What is the severity of CVE-2006-4215?
CVE-2006-4215 has a medium severity rating due to its potential to allow remote code execution.
2
How do I fix CVE-2006-4215?
To fix CVE-2006-4215, you should upgrade Zen Cart to version 1.3.0.3 or later and disable register_globals.
3
What systems are affected by CVE-2006-4215?
CVE-2006-4215 affects Zen Cart versions 1.3.0.2 and earlier when register_globals is enabled.
4
What type of vulnerability is CVE-2006-4215?
CVE-2006-4215 is a remote file inclusion vulnerability that allows attackers to execute arbitrary PHP code.
5
Can CVE-2006-4215 be exploited without authentication?
Yes, CVE-2006-4215 can be exploited remotely without authentication if register_globals is enabled.