Unrated severityNVD Advisory· Published May 22, 2006· Updated Apr 16, 2026
CVE-2006-2516
CVE-2006-2516
Description
mainfile.php in XOOPS 2.0.13.2 and earlier, when register_globals is enabled, allows remote attackers to overwrite variables such as $xoopsOption['nocommon'] and conduct directory traversal attacks or include PHP files via (1) xoopsConfig[language] to misc.php or (2) xoopsConfig[theme_set] to index.php, as demonstrated by injecting PHP sequences into a log file.
Affected products
18cpe:2.3:a:xoops:xoops:*:*:*:*:*:*:*:*+ 17 more
- cpe:2.3:a:xoops:xoops:*:*:*:*:*:*:*:*range: <=2.0.13.2
- cpe:2.3:a:xoops:xoops:2.0:*:*:*:*:*:*:*
- cpe:2.3:a:xoops:xoops:2.0.1:*:*:*:*:*:*:*
- cpe:2.3:a:xoops:xoops:2.0.10:*:*:*:*:*:*:*
- cpe:2.3:a:xoops:xoops:2.0.11:*:*:*:*:*:*:*
- cpe:2.3:a:xoops:xoops:2.0.12_jp:*:*:*:*:*:*:*
- cpe:2.3:a:xoops:xoops:2.0.13.1:*:*:*:*:*:*:*
- cpe:2.3:a:xoops:xoops:2.0.2:*:*:*:*:*:*:*
- cpe:2.3:a:xoops:xoops:2.0.3:*:*:*:*:*:*:*
- cpe:2.3:a:xoops:xoops:2.0.4:*:*:*:*:*:*:*
- cpe:2.3:a:xoops:xoops:2.0.5:*:*:*:*:*:*:*
- cpe:2.3:a:xoops:xoops:2.0.5.1:*:*:*:*:*:*:*
- cpe:2.3:a:xoops:xoops:2.0.5.2:*:*:*:*:*:*:*
- cpe:2.3:a:xoops:xoops:2.0.6:*:*:*:*:*:*:*
- cpe:2.3:a:xoops:xoops:2.0.7:*:*:*:*:*:*:*
- cpe:2.3:a:xoops:xoops:2.0.9:*:*:*:*:*:*:*
- cpe:2.3:a:xoops:xoops:2.0.9.2:*:*:*:*:*:*:*
- cpe:2.3:a:xoops:xoops:2.0.9.3:*:*:*:*:*:*:*
Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
7- secunia.com/advisories/20176nvdExploitVendor Advisory
- www.securityfocus.com/bid/18061nvdExploit
- www.vupen.com/english/advisories/2006/1895nvdVendor Advisory
- securityreason.com/securityalert/934nvd
- www.osvdb.org/25683nvd
- www.securityfocus.com/archive/1/434698/100/0/threadednvd
- www.exploit-db.com/exploits/1811nvd
News mentions
0No linked articles in our index yet.