CVE-2006-2828
Last modified
CVE-2006-2828 is a vulnerability of currently unknown severity. Global variable overwrite vulnerability in PHP-Nuke allows remote attackers to conduct remote PHP file inclusion attacks via a modified phpbb_root_path parameter to the admin scripts (1) index.php, (2) admin_ug_auth.php, (3) admin_board.php, (4) admin_disallow.php, (5) admin_forumauth.php, (6) admin_groups.php, (7) admin_ranks.php, (8) admin_styles.php, (9) admin_user_ban.php, (10) admin_words.php, (11) admin_avatar.php, (12) admin_db_utilities.php, (13) admin_forum_prune.php, (14) admin_forums.php, (15) admin_mass_email.php, (16) admin_smilies.php, (17) admin_ug_auth.php, and (18) admin_users.php, which overwrites $phpbb_root_path when the import_request_variables function is executed after $phpbb_root_path has been initialized to a static value.. EPSS estimates a 2.48% chance of exploitation in the next 30 days.
Description
Global variable overwrite vulnerability in PHP-Nuke allows remote attackers to conduct remote PHP file inclusion attacks via a modified phpbb_root_path parameter to the admin scripts (1) index.php, (2) admin_ug_auth.php, (3) admin_board.php, (4) admin_disallow.php, (5) admin_forumauth.php, (6) admin_groups.php, (7) admin_ranks.php, (8) admin_styles.php, (9) admin_user_ban.php, (10) admin_words.php, (11) admin_avatar.php, (12) admin_db_utilities.php, (13) admin_forum_prune.php, (14) admin_forums.php, (15) admin_mass_email.php, (16) admin_smilies.php, (17) admin_ug_auth.php, and (18) admin_users.php, which overwrites $phpbb_root_path when the import_request_variables function is executed after $phpbb_root_path has been initialized to a static value.
Metrics
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Php-Nuke | Ev | All versions |
References
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2006-2828?
How severe is CVE-2006-2828?
How do I fix CVE-2006-2828?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2006
- CVE-2006-2822SQL injection vulnerability in admin/default.asp in Dusan Dr…
- CVE-2006-2823Katrien De Graeve a.shopKart 2.0 (aka ashopKart20) stores se…
- CVE-2006-2824Logicalware MailManager before 2.0.10 does not remove 0xc8 0…
- CVE-2006-2825cPanel does not automatically synchronize the PHP open_based…
- CVE-2006-2826SQL injection vulnerability in sessions.inc in PHP Base Libr…
- CVE-2006-2827SQL injection vulnerability in search.php in X-Cart Gold and…9.8
- CVE-2006-2829Buffer overflow in Hawk Monitoring Agent (HMA) for TIBCO Haw…
- CVE-2006-2830Buffer overflow in TIBCO Rendezvous before 7.5.1, TIBCO Runt…
- CVE-2006-2831Drupal 4.6.x before 4.6.8 and 4.7.x before 4.7.2, when runni…
- CVE-2006-2832Cross-site scripting (XSS) vulnerability in the upload modul…
- CVE-2006-2833Cross-site scripting (XSS) vulnerability in the taxonomy mod…
- CVE-2006-2834PHP remote file inclusion vulnerability in includes/common.p…
Are you affected by CVE-2006-2828?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST