CVE-2005-3554

phpkit 1.6.1 R2 and earlier - Remote Code Execution via Uninitialized Variables

Title source: llm
STIX 2.1

Description

Multiple eval injection vulnerabilities in the help function in PHPKIT 1.6.1 R2 and earlier, when register_globals is enabled, allow remote attackers to execute arbitrary code on the server via unknown attack vectors involving uninitialized variables.

References (8)

Core 8
Core References
Third Party Advisory, VDB Entry vdb-entry x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/23015
Third Party Advisory, VDB Entry vdb-entry x_refsource_sectrack
http://securitytracker.com/id?1015167
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/15354
Various Sources mailing-list x_refsource_bugtraq
http://cert.uni-stuttgart.de/archive/bugtraq/2005/11/msg00110.html
Third Party Advisory, VDB Entry vdb-entry x_refsource_osvdb
http://www.osvdb.org/20563
Vendor Advisory vdb-entry x_refsource_vupen
http://www.vupen.com/english/advisories/2005/2344
Vendor Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/17479
Exploit, Vendor Advisory x_refsource_misc
http://www.hardened-php.net/advisory_212005.80.html

Scores

EPSS 0.0341
EPSS Percentile 87.4%

Details

CWE
CWE-94
Status published
Products (3)
phpkit/phpkit 1.6.1 (2 CPE variants)
phpkit/phpkit 1.6.02
phpkit/phpkit 1.6.03
Published Nov 16, 2005
Tracked Since Feb 18, 2026