CVE-2006-0479 Security feature bypass in n/a
Remote attackers can bypass security protections in PmWiki when register_globals is enabled, leading to remote file inclusion and cross-site scripting.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2006-0479?
CVE-2006-0479 is a medium-severity vulnerability in n/a, published on 31 Jan 2006. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
pmwiki.php in PmWiki 2.1 beta 20, with register_globals enabled, allows remote attackers to bypass protection mechanisms that deregister global variables by setting both a GPC variable and a GLOBALS[] variable with the same name, which causes PmWiki to unset the GLOBALS[] variable but not the GPC variable, which creates resultant vulnerabilities such as remote file inclusion and cross-site scripting (XSS).
Which versions are affected by CVE-2006-0479?
It affects 1 product.
Products include Pmwiki Pmwiki.
How do I fix CVE-2006-0479?
No fix has been published for CVE-2006-0479 yet. Limit exposure of the affected software until one is available.
Is CVE-2006-0479 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2006-0479 exists.
Public exploit code: 1 Exploit-DB entry.
Other vulnerabilities in n/a
Sources
Also known as GHSA-m9qx-8wqh-76q8.