CVE-2006-2460 Other in n/a
Remote attackers can modify critical variables to achieve directory traversal or remote file inclusion when register_globals is enabled.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2006-2460?
CVE-2006-2460 is a medium-severity vulnerability in Sugarcrm Sugarcrm, published on 19 May 2006. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Sugar Suite Open Source (SugarCRM) 4.2 and earlier, when register_globals is enabled, does not protect critical variables such as $_GLOBALS and $_SESSION from modification, which allows remote attackers to conduct attacks such as directory traversal or PHP remote file inclusion, as demonstrated by modifying the GLOBALS[sugarEntry] parameter.
Which versions are affected by CVE-2006-2460?
It affects 1 product.
Products include Sugarcrm Sugarcrm.
How do I fix CVE-2006-2460?
No fix has been published for CVE-2006-2460 yet. Limit exposure of the affected software until one is available.
Is CVE-2006-2460 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2006-2460 exists.
Public exploit code: 1 Exploit-DB entry.
Other vulnerabilities in Sugarcrm Sugarcrm
Sources
Also known as GHSA-273m-f252-4rf8.