CVE-2006-2516

Xoops < 2.0.13.2 - Path Traversal

Title source: rule

Description

mainfile.php in XOOPS 2.0.13.2 and earlier, when register_globals is enabled, allows remote attackers to overwrite variables such as $xoopsOption['nocommon'] and conduct directory traversal attacks or include PHP files via (1) xoopsConfig[language] to misc.php or (2) xoopsConfig[theme_set] to index.php, as demonstrated by injecting PHP sequences into a log file.

Exploits (1)

exploitdb WORKING POC VERIFIED

by rgod · phpwebappsphp

https://www.exploit-db.com/exploits/1811

View Code ZIP pw:eip

References (7)

[Exploit, Vendor Advisory] http://secunia.com/advisories/20176

[Exploit] http://www.securityfocus.com/bid/18061

[Vendor Advisory] http://www.vupen.com/english/advisories/2006/1895

[Third Party Advisory, VDB Entry] http://www.securityfocus.com/archive/1/434698/100/0/threaded

[Exploit, Third Party Advisory] https://www.exploit-db.com/exploits/1811

[Third Party Advisory, VDB Entry] http://www.osvdb.org/25683

[Third Party Advisory] http://securityreason.com/securityalert/934

Scores

EPSS 0.0524

EPSS Percentile 90.0%

Details

CWE

CWE-22

Status published

Products (18)

xoops/xoops 2.0

xoops/xoops 2.0.1

xoops/xoops 2.0.2

xoops/xoops 2.0.3

xoops/xoops 2.0.4

xoops/xoops 2.0.5

xoops/xoops 2.0.5.1

xoops/xoops 2.0.5.2

xoops/xoops 2.0.6

xoops/xoops 2.0.7

... and 8 more

Published May 22, 2006

Tracked Since Feb 18, 2026