CVE-2006-1688

Multiple PHP remote file inclusion vulnerabilities in SQuery 4.5 and earlier, as used in products such as Autonomous LAN party (ALP), allow remote attackers to execute arbitrary PHP code via a URL in the libpath parameter to scripts in the lib directory including (1) ase.php, (2) devi.php, (3) doom3.php, (4) et.php, (5) flashpoint.php, (6) gameSpy.php, (7) gameSpy2.php, (8) gore.php, (9) gsvari.php, (10) halo.php, (11) hlife.php, (12) hlife2.php, (13) igi2.php, (14) main.lib.php, (15) netpanzer.php, (16) old_hlife.php, (17) pkill.php, (18) q2a.php, (19) q3a.php, (20) qworld.php, (21) rene.php, (22) rvbshld.php, (23) savage.php, (24) simracer.php, (25) sof1.php, (26) sof2.php, (27) unreal.php, (28) ut2004.php, and (29) vietcong.php. NOTE: the lib/armygame.php vector is already covered by CVE-2006-1610. The provenance of most of these additional vectors is unknown, although likely from post-disclosure analysis. NOTE: this only occurs when register_globals is disabled.

• CWE-94

• http://liz0zim.no-ip.org/alp.txtExploit
• http://secunia.com/advisories/19482Vendor Advisory
• http://secunia.com/advisories/19588Vendor Advisory
• http://securityreason.com/securityalert/679
• http://securitytracker.com/id?1015884Exploit
• http://www.blogcu.com/Liz0ziM/431845/Exploit, URL Repurposed
• http://www.osvdb.org/24401
• http://www.osvdb.org/24402
• http://www.osvdb.org/24403
• http://www.osvdb.org/24404
• http://www.osvdb.org/24405
• http://www.osvdb.org/24406
• http://www.osvdb.org/24407Exploit
• http://www.osvdb.org/24408
• http://www.osvdb.org/24409
• http://www.osvdb.org/24410
• http://www.osvdb.org/24411
• http://www.osvdb.org/24412
• http://www.osvdb.org/24413
• http://www.osvdb.org/24414
• http://www.osvdb.org/24415
• http://www.osvdb.org/24416
• http://www.osvdb.org/24417
• http://www.osvdb.org/24418
• http://www.osvdb.org/24419
• http://www.osvdb.org/24420
• http://www.osvdb.org/24421
• http://www.osvdb.org/24422
• http://www.osvdb.org/24423
• http://www.osvdb.org/24424
• http://www.osvdb.org/24425
• http://www.osvdb.org/24426
• http://www.osvdb.org/24427
• http://www.osvdb.org/24428
• http://www.osvdb.org/24429
• http://www.securityfocus.com/archive/1/430289/100/0/threaded
• http://www.securityfocus.com/archive/1/439874/100/0/threaded
• http://www.securityfocus.com/archive/1/441015/100/0/threaded
• http://www.securityfocus.com/bid/17434Exploit
• http://www.vupen.com/english/advisories/2006/1284Vendor Advisory
• http://liz0zim.no-ip.org/alp.txtExploit
• http://secunia.com/advisories/19482Vendor Advisory
• http://secunia.com/advisories/19588Vendor Advisory
• http://securityreason.com/securityalert/679
• http://securitytracker.com/id?1015884Exploit
• http://www.blogcu.com/Liz0ziM/431845/Exploit, URL Repurposed
• http://www.osvdb.org/24401
• http://www.osvdb.org/24402
• http://www.osvdb.org/24403
• http://www.osvdb.org/24404
• http://www.osvdb.org/24405
• http://www.osvdb.org/24406
• http://www.osvdb.org/24407Exploit
• http://www.osvdb.org/24408
• http://www.osvdb.org/24409
• http://www.osvdb.org/24410
• http://www.osvdb.org/24411
• http://www.osvdb.org/24412
• http://www.osvdb.org/24413
• http://www.osvdb.org/24414
• http://www.osvdb.org/24415
• http://www.osvdb.org/24416
• http://www.osvdb.org/24417
• http://www.osvdb.org/24418
• http://www.osvdb.org/24419
• http://www.osvdb.org/24420
• http://www.osvdb.org/24421
• http://www.osvdb.org/24422
• http://www.osvdb.org/24423
• http://www.osvdb.org/24424
• http://www.osvdb.org/24425
• http://www.osvdb.org/24426
• http://www.osvdb.org/24427
• http://www.osvdb.org/24428
• http://www.osvdb.org/24429
• http://www.securityfocus.com/archive/1/430289/100/0/threaded
• http://www.securityfocus.com/archive/1/439874/100/0/threaded
• http://www.securityfocus.com/archive/1/441015/100/0/threaded
• http://www.securityfocus.com/bid/17434Exploit
• http://www.vupen.com/english/advisories/2006/1284Vendor Advisory

Published

Apr 11, 2006

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2006-1682Cross-site scripting (XSS) vulnerability in webplus.exe in T…
• CVE-2006-1683SQL injection vulnerability in admin/login.php in Chipmunk G…
• CVE-2006-1684Unspecified vulnerability in ecotwo Shopsystem 1.0-192 and e…
• CVE-2006-1685Multiple SQL injection vulnerabilities in modules.php in APT…
• CVE-2006-1686Unspecified vulnerability in modules.php in APT-webshop-syst…
• CVE-2006-1687Cross-site scripting (XSS) vulnerability in APT-webshop-syst…
• CVE-2006-1689Unspecified vulnerability in su in HP HP-UX B.11.11, when us…
• CVE-2006-1690Cross-site scripting (XSS) vulnerability in subscribe.php in…
• CVE-2006-1691SQL injection vulnerability in MWNewsletter 1.0.0b allows re…
• CVE-2006-1692Multiple SQL injection vulnerabilities in MWNewsletter 1.0.0…
• CVE-2006-1693Unspecified vulnerability in GlobalSCAPE Secure FTP Server b…
• CVE-2006-1694SQL injection vulnerability in members.php in XBrite Members…