Vulnerability record · CVE-2006-2842 · published 6 June 2006
CVE-2006-2842: SquirrelMail plugin.php remote file inclusion via plugins array
Squirrelmail · Squirrelmail
SquirrelMail 1.4.6 and earlier contains a remote file inclusion flaw in functions/plugin.php: when register_globals is enabled and magic_quotes_gpc is disabled, the plugins array parameter can be set to a remote URL. This lets an attacker cause the application to include and execute arbitrary PHP code. The issue is disputed by third parties who note SquirrelMail warns administrators about register_globals, but the original developer published a security advisory, so real-world exposure depends on that misconfiguration.
Description
PHP remote file inclusion vulnerability in functions/plugin.php in SquirrelMail 1.4.6 and earlier, if register_globals is enabled and magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary PHP code via a URL in the plugins array parameter. NOTE: this issue has been disputed by third parties, who state that Squirrelmail provides prominent warnings to the administrator when register_globals is enabled. Since the varieties of administrator negligence are uncountable, perhaps this type of issue should not be included in CVE. However, the original developer has posted a security advisory, so there might be relevant real-world environments under which this vulnerability is applicable
AV:N/AC:L/Au:N/C:P/I:P/A:P
Automated analysis
high priorityCVSS 2.0 base score is 7.5 (HIGH) with network reachability and no authentication, and public exploit references exist, though exploitation requires specific PHP misconfiguration.
What it is
SquirrelMail 1.4.6 and earlier contains a remote file inclusion flaw in functions/plugin.php: when register_globals is enabled and magic_quotes_gpc is disabled, the plugins array parameter can be set to a remote URL. This lets an attacker cause the application to include and execute arbitrary PHP code. The issue is disputed by third parties who note SquirrelMail warns administrators about register_globals, but the original developer published a security advisory, so real-world exposure depends on that misconfiguration.
Impact
An unauthenticated attacker can execute arbitrary PHP code on the server, leading to full compromise of the web application and potentially the host.
Attack surface
Reachable over the network through HTTP requests to the affected SquirrelMail installation; no authentication or user interaction is required per the CVSS vector AV:N/AC:L/Au:N. Exploitation only works when register_globals is enabled and magic_quotes_gpc is disabled.
Exploitation
Not listed in CISA KEV and no ransomware associations are documented. EPSS is high (0.47196, 98.8th percentile) and a SecurityFocus reference is tagged Exploit, indicating public exploit material exists.
What to do
- Upgrade SquirrelMail to a version containing the fix referenced in the vendor advisory and patch links.
- Disable register_globals in PHP configuration and ensure magic_quotes_gpc is not relied upon for protection.
- Apply vendor or distribution patches (Red Hat, Mandriva, Novell, SGI, Apple advisories) where SquirrelMail is packaged.
- Restrict outbound network access from the web server to limit remote file inclusion fetches.
- Review and harden PHP include paths and disable allow_url_include/allow_url_fopen where feasible.
Detection
- Monitor web logs for requests to functions/plugin.php with a plugins parameter containing a URL or remote host.
- Alert on PHP include or file access events referencing external HTTP/FTP URLs from the SquirrelMail process.
- Search for unexpected PHP files or web shells written under the SquirrelMail web root.
- Audit PHP configuration for register_globals enabled on hosts running SquirrelMail.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2006-2842 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2006-2842), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
