CVEvulnerability

CVE-2006-6661

7.5 HIGH Published 2006-12-20 Modified 2026-06-16 Official page ↗
Status
Modified
Published
2006-12-20
Last modified
2026-06-16
Assigner
[email protected]
CVSS 2.0 ([email protected])
7.5 HIGH — AV:N/AC:L/Au:N/C:P/I:P/A:P

Description

Variable overwrite vulnerability in blog.php in PHP-Update 2.7 and earlier allows remote attackers to overwrite arbitrary program variables and execute arbitrary PHP code via multiple vectors that use the extract function, as demonstrated by the (1) f, (2) newmessage, (3) newusername, (4) adminuser, and (5) permission parameters.

Affected configurations

• php-update php-update (<= 2.7)

Related

Referenced by CWE · observed example (2)

  • CWE-621 Variable Extraction Error weakness
  • CWE-914 Improper Control of Dynamically-Identified Variables weakness

References