CVE-2006-3531

Severity: high (CVSS 7.5 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 9.5% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2006-07-12 · updated 2026-06-16

Description

includes/editor/insert_image.php in Pivot 1.30 RC2 and earlier creates the authentication credentials from parameters, which allows remote attackers to obtain privileges and upload arbitrary files via modified (1) pass and (2) session parameters, and (3) pass and (4) userlevel indices of the (a) Pivot_Vars[] or (b) Users[] array parameters.

Affected products

Pivot: through 1.30_rc2

References

http://retrogod.altervista.org/pivot_130RC2_xpl.html
http://secunia.com/advisories/20962
http://securityreason.com/securityalert/1214
http://www.osvdb.org/27126
http://www.securityfocus.com/archive/1/439495/100/0/threaded
http://www.securityfocus.com/bid/18881
http://www.vupen.com/english/advisories/2006/2744
https://exchange.xforce.ibmcloud.com/vulnerabilities/27671
http://retrogod.altervista.org/pivot_130RC2_xpl.html
http://secunia.com/advisories/20962
http://securityreason.com/securityalert/1214
http://www.osvdb.org/27126

Get alerted when CVE-2006-3531 or the next vulnerability affects your stack