QwikSec

Security Database

CVE

CWE

Training

CVE Database
/

CVE-2006-2667

Back to search

CVE-2006-2667

Published: May 30, 2006

Modified: Aug 7, 2024

PUBLISHED

Description

Direct static code injection vulnerability in WordPress 2.0.2 and earlier allows remote attackers to execute arbitrary commands by inserting a carriage return and PHP code when updating a profile, which is appended after a special comment sequence into files in (1) wp-content/cache/userlogins/ (2) wp-content/cache/users/ which are later included by cache.php, as demonstrated using the displayname argument.

VendorProductVersions

n/a

n/a

affected
n/a

References

20271
third-party-advisory
x_refsource_SECUNIA
25777
vdb-entry
x_refsource_OSVDB
ADV-2006-1992
vdb-entry
x_refsource_VUPEN
20608
third-party-advisory
x_refsource_SECUNIA
GLSA-200606-08
vendor-advisory
x_refsource_GENTOO
18372
vdb-entry
x_refsource_BID

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Start Training

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.

Scan Now