CoreCVE
Back

MEDIUM

php: Improper validation of strings in ip2long function (remote attackers able to obtain network information and facilitate other attacks)

Published Aug 9, 2006

Description

The ip2long function in PHP 5.1.4 and earlier may incorrectly validate an arbitrary string and return a valid network IP address, which allows remote attackers to obtain network information and facilitate other attacks, as demonstrated using SQL injection in the X-FORWARDED-FOR Header in index.php in MiniBB 2.0. NOTE: it could be argued that the ip2long behavior represents a risk for security-relevant issues in a way that is similar to strcpy's role in buffer overflows, in which case this would be a class of implementation bugs that would require separate CVE items for each PHP application that uses ip2long in a security-relevant manner.

Affected products

Remediation

No remediation recorded yet.

Metrics

Weaknesses (1)

CWE-20

Improper Input Validation

References (8)

Change history (0)

No recorded changes yet.

Sources
CVE.org / MITRE
Status PUBLISHED
Assigner mitre
Published Aug 9, 2006
Updated Aug 7, 2024
Reserved Aug 8, 2006
Link CVE-2006-4023
CISA Vulnrichment
Updated n/a
NVD
Status Modified
Modified Jun 16, 2026
Link CVE-2006-4023
Red Hat
Severity Low
Public date Jul 29, 2006
Links CVE-2006-4023 - Bugzilla