CVE-2005-3926

GuppY <4.5.9 - Code Injection

Title source: llm

Description

Direct static code injection vulnerability in error.php in GuppY 4.5.9 and earlier, when register_globals is disabled, allows remote attackers to execute arbitrary PHP code via the _SERVER[REMOTE_ADDR] parameter, which is injected into a .inc script that is later included by the main script.

Exploits (1)

exploitdb WORKING POC VERIFIED

by rgod · phpwebappsphp

https://www.exploit-db.com/exploits/1342

View Code ZIP pw:eip

References (7)

[Exploit] http://securitytracker.com/id?1015279

[Third Party Advisory, VDB Entry] http://www.securityfocus.com/archive/1/417899/100/0/threaded

[Vendor Advisory] http://secunia.com/advisories/17790

[Exploit] http://www.securityfocus.com/bid/15609

[Third Party Advisory, VDB Entry] https://exchange.xforce.ibmcloud.com/vulnerabilities/23318

[Exploit, Vendor Advisory] http://rgod.altervista.org/guppy459_xpl.html

[Third Party Advisory] http://www.vupen.com/english/advisories/2005/2635

Scores

EPSS 0.0561

EPSS Percentile 90.3%

Details

Status published

Products (5)

guppy/guppy 4.5

guppy/guppy 4.5.3

guppy/guppy 4.5.3a

guppy/guppy 4.5.4

guppy/guppy 4.5.9

Published Nov 30, 2005

Tracked Since Feb 18, 2026