CVE-2006-2158

Severity: medium (CVSS 6.4 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.6% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2006-05-03 · updated 2026-06-16

Description

Dynamic variable evaluation vulnerability in index.php in Stadtaus Guestbook Script 1.7 and earlier, when register_globals is enabled, allows remote attackers to modify arbitrary program variables via parameters, which are evaluated as PHP variable variables, as demonstrated by performing PHP remote file inclusion using the include_files array parameter.

Affected products

Stadtaus Guestbook Script: through 1.7

References

http://retrogod.altervista.org/gbs_17_xpl_pl.html
http://secunia.com/advisories/19957
http://www.securityfocus.com/bid/17845
http://www.stadtaus.com/forum/t-2600.html
http://www.vupen.com/english/advisories/2006/1660
https://exchange.xforce.ibmcloud.com/vulnerabilities/26252
http://retrogod.altervista.org/gbs_17_xpl_pl.html
http://secunia.com/advisories/19957
http://www.securityfocus.com/bid/17845
http://www.stadtaus.com/forum/t-2600.html
http://www.vupen.com/english/advisories/2006/1660
https://exchange.xforce.ibmcloud.com/vulnerabilities/26252

Get alerted when CVE-2006-2158 or the next vulnerability affects your stack