CVE-2006-4210 describes a vulnerability in Andreas Kansok phPay versions 2.02 and 2.02.1, specifically within the nu_mail.inc.php script. When the register_globals setting is enabled, remote attackers can exploit this flaw to use the affected server as an open mail relay by manipulating specific mail-related parameters. The vulnerability has a CVSS score of 2.6 (AV:N/AC:H/Au:N/C:N/I:P/A:N), indicating a network-based attack with high access complexity, requiring no authentication. The primary impact is partial integrity compromise, allowing the server to be abused for sending unsolicited mail. While not listed on the CISA KEV catalog or Hot List, exploit code for this vulnerability is publicly available on ExploitDB. Despite this, there is no evidence of active exploitation, and it has received very limited community discussion or media coverage.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
2.02CPE matchmatch criteria | cpe:2.3:a:andreas_kansok:phpay:2.02:*:*:*:*:*:*:* | ||
2.02.1CPE matchmatch criteria | cpe:2.3:a:andreas_kansok:phpay:2.02.1:*:*:*:*:*:*:* |
CVSS version used by this source: 2.0
AV:N/AC:H/Au:N/C:N/I:P/A:N
No social media mentions found for this CVE.
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.3 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.0 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.