« Volver al listado

CVE-2006-3069

Estado: ModificadaAlta (7.5)—

PHP remote file inclusion vulnerability in DoubleSpeak 0.1, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via the config[private] parameter in multiple files, as demonstrated by (1) index.php, (2) faq.php, and (3) hardware.php. NOTE: this issue has been disputed by multiple third-party researchers, who state that config[private] is initialized in an include file before being used

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Iglooweb — Doublespeak

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2006-3069",
  "cveTags": [
    {
      "tags": [
        "disputed"
      ],
      "sourceIdentifier": "cve@mitre.org"
    }
  ],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 7.5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "LOW",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 6.4,
        "baseSeverity": "HIGH",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": true,
        "userInteractionRequired": false
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2006-06-19T10:02:00.000",
  "references": [
    {
      "url": "http://archives.neohapsis.com/archives/bugtraq/2006-06/0184.html",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://attrition.org/pipermail/vim/2006-July/000935.html",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://securitytracker.com/id?1016278",
      "tags": [
        "Exploit"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.aria-security.net/advisory/igloo/doublespeak.txt",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.osvdb.org/27436",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.securityfocus.com/bid/18401",
      "tags": [
        "Exploit"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://archives.neohapsis.com/archives/bugtraq/2006-06/0184.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://attrition.org/pipermail/vim/2006-July/000935.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://securitytracker.com/id?1016278",
      "tags": [
        "Exploit"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.aria-security.net/advisory/igloo/doublespeak.txt",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.osvdb.org/27436",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securityfocus.com/bid/18401",
      "tags": [
        "Exploit"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-Other"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "PHP remote file inclusion vulnerability in DoubleSpeak 0.1, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via the config[private] parameter in multiple files, as demonstrated by (1) index.php, (2) faq.php, and (3) hardware.php. NOTE: this issue has been disputed by multiple third-party researchers, who state that config[private] is initialized in an include file before being used"
    },
    {
      "lang": "es",
      "value": "** CONTROVERTIDO **  Una vulnerabilidad de inclusión de archivo PHP remoto en DoubleSpeak 0.1, cuando register_globals está habilitado, permite a atacantes remotos ejecutar código PHP a través de la configuración de parámetros [privado] en varios archivos, como lo demuestra (1) index.php, (2) faq.php, y (3) hardware.php. NOTA: este problema ha sido disputado por varios investigadores de terceros, que afirman que config [privada] se inicializa en un archivo de inclusión antes de ser utilizado."
    }
  ],
  "lastModified": "2026-06-16T22:26:20.043",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:iglooweb:doublespeak:0.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "1CAE1D6A-66AC-4407-9DE0-092576E6C82B"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}