CVE-2006-0881

Severity: high (CVSS 7.5 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 7.7% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2006-02-24 · updated 2026-06-16

Description

Multiple PHP remote file include vulnerabilities in gorum/gorumlib.php in Noah's Classifieds 1.3, when register_globals is enabled, allow remote attackers to include arbitrary PHP files via the (1) upperTemplate and (2) lowerTemplate parameters, as demonstrated using the lowerTemplate parameter to index.php.

Affected products

Phpoutsourcing Noahs Classifieds: 1.2, 1.3

References

http://securitytracker.com/id?1015667
http://www.kapda.ir/advisory-268.html
http://www.securityfocus.com/archive/1/425783/100/0/threaded
http://www.securityfocus.com/bid/16780
http://www.vupen.com/english/advisories/2006/0703
https://exchange.xforce.ibmcloud.com/vulnerabilities/24899
http://securitytracker.com/id?1015667
http://www.kapda.ir/advisory-268.html
http://www.securityfocus.com/archive/1/425783/100/0/threaded
http://www.securityfocus.com/bid/16780
http://www.vupen.com/english/advisories/2006/0703
https://exchange.xforce.ibmcloud.com/vulnerabilities/24899

Get alerted when CVE-2006-0881 or the next vulnerability affects your stack