CVE-2006-2842 Code injection in n/a
Remote attackers can execute arbitrary PHP code in SquirrelMail if register_globals is enabled and magic_quotes_gpc is disabled.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2006-2842?
CVE-2006-2842 is a high-severity code injection vulnerability in Squirrelmail Squirrelmail, published on 6 Jun 2006. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
PHP remote file inclusion vulnerability in functions/plugin.php in SquirrelMail 1.4.6 and earlier, if register_globals is enabled and magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary PHP code via a URL in the plugins array parameter. NOTE: this issue has been disputed by third parties, who state that Squirrelmail provides prominent warnings to the administrator when register_globals is enabled. Since the varieties of administrator negligence are uncountable, perhaps this type of issue should not be included in CVE. However, the original developer has posted a security advisory, so there might be relevant real-world environments under which this vulnerability is applicable
Which versions are affected by CVE-2006-2842?
It affects 1 product.
Linux distribution packages (8)
squirrelmail Red Hat:enterprise_linux:3::as | All versions | 0:1.4.6-7.el3 |
squirrelmail Red Hat:enterprise_linux:3::desktop | All versions | 0:1.4.6-7.el3 |
squirrelmail Red Hat:enterprise_linux:3::es | All versions | 0:1.4.6-7.el3 |
squirrelmail Red Hat:enterprise_linux:3::ws | All versions | 0:1.4.6-7.el3 |
squirrelmail Red Hat:enterprise_linux:4::as | All versions | 0:1.4.6-7.el4 |
squirrelmail Red Hat:enterprise_linux:4::desktop | All versions | 0:1.4.6-7.el4 |
squirrelmail Red Hat:enterprise_linux:4::es | All versions | 0:1.4.6-7.el4 |
squirrelmail Red Hat:enterprise_linux:4::ws | All versions | 0:1.4.6-7.el4 |
Products include Squirrelmail Squirrelmail.
How do I fix CVE-2006-2842?
Change a configuration setting.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2006-2842 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2006-2842 exists.
Public exploit code: 1 Exploit-DB entry, 1 Nuclei template and 1 proofs of concept on GitHub.
Other vulnerabilities in Squirrelmail Squirrelmail
Sources
Also known as GHSA-h9qp-9p74-vrxm, RHSA-2006:0547.