CVE-2006-4877 - Vulnerability Details - OpenCVE

Variable overwrite vulnerability in David Bennett PHP-Post (PHPp) 1.0 and earlier allows remote attackers to overwrite arbitrary program variables via multiple vectors that use the extract function, as demonstrated by the table_prefix parameter in (1) index.php, (2) profile.php, and (3) header.php.

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

Access Vector Network

Access Complexity Low

Authentication None

Confidentiality Impact None

Integrity Impact Partial

Availability Impact None

This CVE is not in the KEV list.

The EPSS score is 0.07425.

Key SSVC decision points have not yet been added.

Vendors	Products
David Bennett	Php-post

Configuration 1 [-]

cpe:2.3:a:david_bennett:php-post:*:*:*:*:*:*:*:*

No data.

No data.

Advisories

Source	ID	Title
EUVD	EUVD-2006-4864	Variable overwrite vulnerability in David Bennett PHP-Post (PHPp) 1.0 and earlier allows remote attackers to overwrite arbitrary program variables via multiple vectors that use the extract function, as demonstrated by the table_prefix parameter in (1) index.php, (2) profile.php, and (3) header.php.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References

Link	Providers
http://secunia.com/advisories/22014
http://securityreason.com/securityalert/1607
http://www.osvdb.org/28965
http://www.osvdb.org/28966
http://www.osvdb.org/28967
http://www.securityfocus.com/archive/1/446318/100/0/threaded
http://www.securityfocus.com/bid/20061
http://www.vupen.com/english/advisories/2006/3688

History

No history.

MITRE

Status: PUBLISHED

Assigner: mitre

Published: 2006-09-19T21:00:00

Updated: 2024-08-07T19:32:21.940Z

Reserved: 2006-09-19T00:00:00

Link: CVE-2006-4877

Vulnrichment

No data.

NVD

Status : Deferred

Published: 2006-09-19T21:07:00.000

Modified: 2025-04-03T01:03:51.193

Link: CVE-2006-4877

Redhat

No data.

OpenCVE Enrichment

No data.

{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "datePublic": "2006-09-16T00:00:00", "descriptions": [{"lang": "en", "value": "Variable overwrite vulnerability in David Bennett PHP-Post (PHPp) 1.0 and earlier allows remote attackers to overwrite arbitrary program variables via multiple vectors that use the extract function, as demonstrated by the table_prefix parameter in (1) index.php, (2) profile.php, and (3) header.php."}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2018-10-17T20:57:01", "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre"}, "references": [{"name": "20061", "tags": ["vdb-entry", "x_refsource_BID"], "url": "http://www.securityfocus.com/bid/20061"}, {"name": "ADV-2006-3688", "tags": ["vdb-entry", "x_refsource_VUPEN"], "url": "http://www.vupen.com/english/advisories/2006/3688"}, {"name": "28966", "tags": ["vdb-entry", "x_refsource_OSVDB"], "url": "http://www.osvdb.org/28966"}, {"name": "1607", "tags": ["third-party-advisory", "x_refsource_SREASON"], "url": "http://securityreason.com/securityalert/1607"}, {"name": "28967", "tags": ["vdb-entry", "x_refsource_OSVDB"], "url": "http://www.osvdb.org/28967"}, {"name": "22014", "tags": ["third-party-advisory", "x_refsource_SECUNIA"], "url": "http://secunia.com/advisories/22014"}, {"name": "20060916 PHP-Post Multiple Input Validation Vulnerabilities", "tags": ["mailing-list", "x_refsource_BUGTRAQ"], "url": "http://www.securityfocus.com/archive/1/446318/100/0/threaded"}, {"name": "28965", "tags": ["vdb-entry", "x_refsource_OSVDB"], "url": "http://www.osvdb.org/28965"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "cve@mitre.org", "ID": "CVE-2006-4877", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "Variable overwrite vulnerability in David Bennett PHP-Post (PHPp) 1.0 and earlier allows remote attackers to overwrite arbitrary program variables via multiple vectors that use the extract function, as demonstrated by the table_prefix parameter in (1) index.php, (2) profile.php, and (3) header.php."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "20061", "refsource": "BID", "url": "http://www.securityfocus.com/bid/20061"}, {"name": "ADV-2006-3688", "refsource": "VUPEN", "url": "http://www.vupen.com/english/advisories/2006/3688"}, {"name": "28966", "refsource": "OSVDB", "url": "http://www.osvdb.org/28966"}, {"name": "1607", "refsource": "SREASON", "url": "http://securityreason.com/securityalert/1607"}, {"name": "28967", "refsource": "OSVDB", "url": "http://www.osvdb.org/28967"}, {"name": "22014", "refsource": "SECUNIA", "url": "http://secunia.com/advisories/22014"}, {"name": "20060916 PHP-Post Multiple Input Validation Vulnerabilities", "refsource": "BUGTRAQ", "url": "http://www.securityfocus.com/archive/1/446318/100/0/threaded"}, {"name": "28965", "refsource": "OSVDB", "url": "http://www.osvdb.org/28965"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-07T19:32:21.940Z"}, "title": "CVE Program Container", "references": [{"name": "20061", "tags": ["vdb-entry", "x_refsource_BID", "x_transferred"], "url": "http://www.securityfocus.com/bid/20061"}, {"name": "ADV-2006-3688", "tags": ["vdb-entry", "x_refsource_VUPEN", "x_transferred"], "url": "http://www.vupen.com/english/advisories/2006/3688"}, {"name": "28966", "tags": ["vdb-entry", "x_refsource_OSVDB", "x_transferred"], "url": "http://www.osvdb.org/28966"}, {"name": "1607", "tags": ["third-party-advisory", "x_refsource_SREASON", "x_transferred"], "url": "http://securityreason.com/securityalert/1607"}, {"name": "28967", "tags": ["vdb-entry", "x_refsource_OSVDB", "x_transferred"], "url": "http://www.osvdb.org/28967"}, {"name": "22014", "tags": ["third-party-advisory", "x_refsource_SECUNIA", "x_transferred"], "url": "http://secunia.com/advisories/22014"}, {"name": "20060916 PHP-Post Multiple Input Validation Vulnerabilities", "tags": ["mailing-list", "x_refsource_BUGTRAQ", "x_transferred"], "url": "http://www.securityfocus.com/archive/1/446318/100/0/threaded"}, {"name": "28965", "tags": ["vdb-entry", "x_refsource_OSVDB", "x_transferred"], "url": "http://www.osvdb.org/28965"}]}]}, "cveMetadata": {"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "cveId": "CVE-2006-4877", "datePublished": "2006-09-19T21:00:00", "dateReserved": "2006-09-19T00:00:00", "dateUpdated": "2024-08-07T19:32:21.940Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:david_bennett:php-post:*:*:*:*:*:*:*:*", "matchCriteriaId": "70FA6839-10EF-409D-AE8E-31F1DD908165", "versionEndIncluding": "1.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Variable overwrite vulnerability in David Bennett PHP-Post (PHPp) 1.0 and earlier allows remote attackers to overwrite arbitrary program variables via multiple vectors that use the extract function, as demonstrated by the table_prefix parameter in (1) index.php, (2) profile.php, and (3) header.php."}, {"lang": "es", "value": "Vulnerabilidad de sobreescritura de variable en David Bennett PHP-Post (PHPp) 1.0 y anteriores permite a atacantes remotos sobreescribir variables de programa de su elecci\u00f3n v\u00eda m\u00faltiples vectores que usan la funci\u00f3n extract, como ha sido demostrado por el par\u00e1metro table_prefix en (1) index.php, (2) profile.php y (3) header.php."}], "id": "CVE-2006-4877", "lastModified": "2025-04-03T01:03:51.193", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 5.0, "confidentialityImpact": "NONE", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}]}, "published": "2006-09-19T21:07:00.000", "references": [{"source": "cve@mitre.org", "url": "http://secunia.com/advisories/22014"}, {"source": "cve@mitre.org", "url": "http://securityreason.com/securityalert/1607"}, {"source": "cve@mitre.org", "url": "http://www.osvdb.org/28965"}, {"source": "cve@mitre.org", "url": "http://www.osvdb.org/28966"}, {"source": "cve@mitre.org", "url": "http://www.osvdb.org/28967"}, {"source": "cve@mitre.org", "url": "http://www.securityfocus.com/archive/1/446318/100/0/threaded"}, {"source": "cve@mitre.org", "url": "http://www.securityfocus.com/bid/20061"}, {"source": "cve@mitre.org", "url": "http://www.vupen.com/english/advisories/2006/3688"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://secunia.com/advisories/22014"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://securityreason.com/securityalert/1607"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.osvdb.org/28965"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.osvdb.org/28966"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.osvdb.org/28967"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.securityfocus.com/archive/1/446318/100/0/threaded"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.securityfocus.com/bid/20061"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.vupen.com/english/advisories/2006/3688"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-Other"}], "source": "nvd@nist.gov", "type": "Primary"}]}