The ip2long function in PHP 5.1.4 and earlier may incorrectly validate an arbitrary string and return a valid network IP address, which allows remote attackers to obtain network information and facilitate other attacks, as demonstrated using SQL injection in the X-FORWARDED-FOR Header in index.php in MiniBB 2.0. NOTE: it could be argued that the ip2long behavior represents a risk for security-relevant issues in a way that is similar to strcpy's role in buffer overflows, in which case this would be a class of implementation bugs that would require separate CVE items for each PHP application that uses ip2long in a security-relevant manner.
Published 2006-08-09 00:04:00
Updated 2018-10-17 21:32:59
Source MITRE
View at NVD,   CVE.org
Vulnerability category: Sql Injection

Products affected by CVE-2006-4023

Threat overview for CVE-2006-4023

Top countries where our scanners detected CVE-2006-4023
Top open port discovered on systems with this issue 80
IPs affected by CVE-2006-4023 450
Threat actors abusing to this issue? Yes
Find out if you* are affected by CVE-2006-4023!
*Directly or indirectly through your vendors, service providers and 3rd parties. Powered by attack surface intelligence from SecurityScorecard.

Exploit prediction scoring system (EPSS) score for CVE-2006-4023

0.33%
Probability of exploitation activity in the next 30 days EPSS Score History
~ 70 %
Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2006-4023

Base Score Base Severity CVSS Vector Exploitability Score Impact Score Score Source First Seen
5.0
MEDIUM AV:N/AC:L/Au:N/C:P/I:N/A:N
10.0
2.9
NIST
Jump to
This web site uses cookies for managing your session, storing preferences, website analytics and additional purposes described in our privacy policy.
By using this web site you are agreeing to CVEdetails.com terms of use!