phpGraphy before 0.9.13a does not properly unset variables when the input data includes a numeric parameter with a value matching an…

Description

phpGraphy before 0.9.13a does not properly unset variables when the input data includes a numeric parameter with a value matching an alphanumeric parameter's hash value, which allows remote attackers to execute arbitrary PHP code by uploading a config.php file via the pictures[] parameter to index.php. NOTE: it could be argued that this vulnerability is due to a bug in the unset PHP command (CVE-2006-3017) and the proper fix should be in PHP; if so, then this should not be treated as a vulnerability in phpGraphy.

Scores

EPSS (exploitation in 30 days)

2.6% · top 15% of all CVEs (4 Nov 2026)

The list uses the assigner's score when there is one, then CISA's, then NVD's: High 7.5.

Weakness

• n/a

Affected products

• n/a

  • affected n/a

References (5)

• http://phpgraphy.sourceforge.net/changelog.php (opens in a new tab)x_refsource_CONFIRMx_transferred
• http://sourceforge.net/forum/forum.php?forum_id=659277 (opens in a new tab)x_refsource_CONFIRMx_transferred
• 1017571 (opens in a new tab)vdb-entryx_refsource_SECTRACKx_transferred
• phpgraphy-config-file-include(30634) (opens in a new tab)vdb-entryx_refsource_XFx_transferred
• http://retrogod.altervista.org/phpgraphy_0912_zhdkoi_cmd.html (opens in a new tab)x_refsource_MISCx_transferred

Sources

The same CVE in the primary databases and aggregators, to check against.

• CVE.org record (opens in a new tab)
• CVE List JSON (GitHub) (opens in a new tab)
• NVD (opens in a new tab)
• FIRST EPSS (opens in a new tab)
• OSV.dev (opens in a new tab)
• GitHub Advisories (opens in a new tab)
• CIRCL Vulnerability-Lookup (opens in a new tab)

Badge for a README or a ticket

[![CVE-2006-6966](https://trackcve.app/badge/CVE-2006-6966.svg)](https://trackcve.app/cve/CVE-2006-6966)

Record last updated 7 Aug 2024, 20:50 UTC.