CVE-2006-0144: php pear Code Injection

Vulnerability summary

CVE-2006-0144 is a high (CVSS 7.5) Code Injection vulnerability in php pear. EPSS estimates a 1.83% chance of exploitation in the next 30 days, higher than 78.5% of scored vulnerabilities.

Timeline

1. 09-01-2006
   PublishedVulnerability first disclosed.
2. 07-08-2024
   Last modifiedVulnerability information updated.

Description

The proxy server feature in go-pear.php in PHP PEAR 0.2.2, as used in Apache2Triad, allows remote attackers to execute arbitrary PHP code by redirecting go-pear.php to a malicious proxy server that provides a modified version of Tar.php with a malicious extractModify function.

• CWE-94Improper Control of Generation of Code ('Code Injection')The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.