CVE-2006-5186 - Vulnerability Details - OpenCVE

PHP remote file inclusion vulnerability in functions.php in phpMyProfiler 0.9.6 and earlier, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the pmp_rel_path parameter.

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

Access Vector Network

Access Complexity High

Authentication None

Confidentiality Impact Partial

Integrity Impact Partial

Availability Impact Partial

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Phpmyprofiler	Phpmyprofiler

Configuration 1 [-]

cpe:2.3:a:phpmyprofiler:phpmyprofiler:*:*:*:*:*:*:*:*

No data.

References

Link	Providers
http://forum.phpmyprofiler.de/viewtopic.php?p=2745#2745
http://secunia.com/advisories/22144
http://securityreason.com/securityalert/1696
http://securitytracker.com/id?1016980
http://www.phpmyprofiler.de/index.php?page=2
http://www.securityfocus.com/archive/1/447646/100/0/threaded
http://www.securityfocus.com/bid/20324
http://www.vupen.com/english/advisories/2006/3896
https://exchange.xforce.ibmcloud.com/vulnerabilities/29335
https://www.exploit-db.com/exploits/2470

History

No history.

MITRE

Status: PUBLISHED

Assigner: mitre

Published: 2006-10-06T19:00:00

Updated: 2024-08-07T19:41:04.431Z

Reserved: 2006-10-06T00:00:00

Link: CVE-2006-5186

Vulnrichment

No data.

NVD

Status : Deferred

Published: 2006-10-10T04:06:00.000

Modified: 2025-04-09T00:30:58.490

Link: CVE-2006-5186

Redhat

No data.

{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "datePublic": "2006-10-03T00:00:00", "descriptions": [{"lang": "en", "value": "PHP remote file inclusion vulnerability in functions.php in phpMyProfiler 0.9.6 and earlier, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the pmp_rel_path parameter."}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2018-10-17T20:57:01", "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre"}, "references": [{"tags": ["x_refsource_CONFIRM"], "url": "http://forum.phpmyprofiler.de/viewtopic.php?p=2745#2745"}, {"name": "20061003 phpMyProfiler remote file include", "tags": ["mailing-list", "x_refsource_BUGTRAQ"], "url": "http://www.securityfocus.com/archive/1/447646/100/0/threaded"}, {"name": "ADV-2006-3896", "tags": ["vdb-entry", "x_refsource_VUPEN"], "url": "http://www.vupen.com/english/advisories/2006/3896"}, {"name": "22144", "tags": ["third-party-advisory", "x_refsource_SECUNIA"], "url": "http://secunia.com/advisories/22144"}, {"name": "1696", "tags": ["third-party-advisory", "x_refsource_SREASON"], "url": "http://securityreason.com/securityalert/1696"}, {"tags": ["x_refsource_CONFIRM"], "url": "http://www.phpmyprofiler.de/index.php?page=2"}, {"name": "phpmyprofiler-functions-file-include(29335)", "tags": ["vdb-entry", "x_refsource_XF"], "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/29335"}, {"name": "20324", "tags": ["vdb-entry", "x_refsource_BID"], "url": "http://www.securityfocus.com/bid/20324"}, {"name": "1016980", "tags": ["vdb-entry", "x_refsource_SECTRACK"], "url": "http://securitytracker.com/id?1016980"}, {"name": "2470", "tags": ["exploit", "x_refsource_EXPLOIT-DB"], "url": "https://www.exploit-db.com/exploits/2470"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "cve@mitre.org", "ID": "CVE-2006-5186", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "PHP remote file inclusion vulnerability in functions.php in phpMyProfiler 0.9.6 and earlier, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the pmp_rel_path parameter."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "http://forum.phpmyprofiler.de/viewtopic.php?p=2745#2745", "refsource": "CONFIRM", "url": "http://forum.phpmyprofiler.de/viewtopic.php?p=2745#2745"}, {"name": "20061003 phpMyProfiler remote file include", "refsource": "BUGTRAQ", "url": "http://www.securityfocus.com/archive/1/447646/100/0/threaded"}, {"name": "ADV-2006-3896", "refsource": "VUPEN", "url": "http://www.vupen.com/english/advisories/2006/3896"}, {"name": "22144", "refsource": "SECUNIA", "url": "http://secunia.com/advisories/22144"}, {"name": "1696", "refsource": "SREASON", "url": "http://securityreason.com/securityalert/1696"}, {"name": "http://www.phpmyprofiler.de/index.php?page=2", "refsource": "CONFIRM", "url": "http://www.phpmyprofiler.de/index.php?page=2"}, {"name": "phpmyprofiler-functions-file-include(29335)", "refsource": "XF", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/29335"}, {"name": "20324", "refsource": "BID", "url": "http://www.securityfocus.com/bid/20324"}, {"name": "1016980", "refsource": "SECTRACK", "url": "http://securitytracker.com/id?1016980"}, {"name": "2470", "refsource": "EXPLOIT-DB", "url": "https://www.exploit-db.com/exploits/2470"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-07T19:41:04.431Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "http://forum.phpmyprofiler.de/viewtopic.php?p=2745#2745"}, {"name": "20061003 phpMyProfiler remote file include", "tags": ["mailing-list", "x_refsource_BUGTRAQ", "x_transferred"], "url": "http://www.securityfocus.com/archive/1/447646/100/0/threaded"}, {"name": "ADV-2006-3896", "tags": ["vdb-entry", "x_refsource_VUPEN", "x_transferred"], "url": "http://www.vupen.com/english/advisories/2006/3896"}, {"name": "22144", "tags": ["third-party-advisory", "x_refsource_SECUNIA", "x_transferred"], "url": "http://secunia.com/advisories/22144"}, {"name": "1696", "tags": ["third-party-advisory", "x_refsource_SREASON", "x_transferred"], "url": "http://securityreason.com/securityalert/1696"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "http://www.phpmyprofiler.de/index.php?page=2"}, {"name": "phpmyprofiler-functions-file-include(29335)", "tags": ["vdb-entry", "x_refsource_XF", "x_transferred"], "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/29335"}, {"name": "20324", "tags": ["vdb-entry", "x_refsource_BID", "x_transferred"], "url": "http://www.securityfocus.com/bid/20324"}, {"name": "1016980", "tags": ["vdb-entry", "x_refsource_SECTRACK", "x_transferred"], "url": "http://securitytracker.com/id?1016980"}, {"name": "2470", "tags": ["exploit", "x_refsource_EXPLOIT-DB", "x_transferred"], "url": "https://www.exploit-db.com/exploits/2470"}]}]}, "cveMetadata": {"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "cveId": "CVE-2006-5186", "datePublished": "2006-10-06T19:00:00", "dateReserved": "2006-10-06T00:00:00", "dateUpdated": "2024-08-07T19:41:04.431Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:phpmyprofiler:phpmyprofiler:*:*:*:*:*:*:*:*", "matchCriteriaId": "DFD8CC58-8629-45B0-8BCE-EF2E472D1156", "versionEndIncluding": "0.9.6", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "PHP remote file inclusion vulnerability in functions.php in phpMyProfiler 0.9.6 and earlier, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the pmp_rel_path parameter."}, {"lang": "es", "value": "Vulnerabilidad de inclusi\u00f3n remota de archivo en PHP en functions.php en phpMyProfiler 0.9.6 y anteriores, cuando register_globals est\u00e1 activado, permite a atacantes remotos ejecutar c\u00f3digo PHP de su elecci\u00f3n mediante una URL en el par\u00e1metro pmp_rel_path."}], "evaluatorSolution": "Successful exploitation requires that \"register_globals\" is enabled.\r\nThis vulnerability is addressed in the following product update:\r\nphpMyProfiler, phpMyProfiler, 0.9.6b", "id": "CVE-2006-5186", "lastModified": "2025-04-09T00:30:58.490", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "HIGH", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 5.1, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:H/Au:N/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 4.9, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": true, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}]}, "published": "2006-10-10T04:06:00.000", "references": [{"source": "cve@mitre.org", "tags": ["Patch"], "url": "http://forum.phpmyprofiler.de/viewtopic.php?p=2745#2745"}, {"source": "cve@mitre.org", "tags": ["Patch", "Vendor Advisory"], "url": "http://secunia.com/advisories/22144"}, {"source": "cve@mitre.org", "url": "http://securityreason.com/securityalert/1696"}, {"source": "cve@mitre.org", "tags": ["Exploit", "Patch"], "url": "http://securitytracker.com/id?1016980"}, {"source": "cve@mitre.org", "tags": ["Patch"], "url": "http://www.phpmyprofiler.de/index.php?page=2"}, {"source": "cve@mitre.org", "url": "http://www.securityfocus.com/archive/1/447646/100/0/threaded"}, {"source": "cve@mitre.org", "tags": ["Exploit"], "url": "http://www.securityfocus.com/bid/20324"}, {"source": "cve@mitre.org", "url": "http://www.vupen.com/english/advisories/2006/3896"}, {"source": "cve@mitre.org", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/29335"}, {"source": "cve@mitre.org", "url": "https://www.exploit-db.com/exploits/2470"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "http://forum.phpmyprofiler.de/viewtopic.php?p=2745#2745"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch", "Vendor Advisory"], "url": "http://secunia.com/advisories/22144"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://securityreason.com/securityalert/1696"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit", "Patch"], "url": "http://securitytracker.com/id?1016980"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "http://www.phpmyprofiler.de/index.php?page=2"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.securityfocus.com/archive/1/447646/100/0/threaded"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit"], "url": "http://www.securityfocus.com/bid/20324"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.vupen.com/english/advisories/2006/3896"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/29335"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://www.exploit-db.com/exploits/2470"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-Other"}], "source": "nvd@nist.gov", "type": "Primary"}]}