What is the CVSS score of CVE-2006-5840?

CVE-2006-5840 has a CVSS 2.0 base score of 7.5 (High). CVSS vector: AV:N/AC:L/Au:N/C:P/I:P/A:P. EPSS exploitation probability: 2.7%.

Which versions of PHP are affected by CVE-2006-5840?

CVE-2006-5840 presents notable security risk, a SQL injection vulnerability rated CVSS 7.5.

Is there a public PoC exploit available for CVE-2006-5840?

Yes, a public proof-of-concept exploit is available for CVE-2006-5840. Prioritise patching immediately. EPSS: 2.7%.

How to fix or mitigate CVE-2006-5840?

Within 7 days: Identify all affected systems and apply vendor patches promptly. Validate that input sanitization is in place for all user-controlled parameters.

PHP CVE-2006-5840

HIGH

SQL Injection (CWE-89)

2006-11-10 cve@mitre.org

SQLi PHP Abarcar Realty Portal

7.5

CVSS 2.0 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/Au:N/C:P/I:P/A:P

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

AV:N/AC:L/Au:N/C:P/I:P/A:P

Attack Vector

Network

Attack Complexity

Low

Confidentiality

Integrity

Availability

Lifecycle Timeline

Analysis Generated

Mar 13, 2026 - 18:30 vuln.today

PoC Detected

Mar 13, 2026 - 17:25 vuln.today

Public exploit code

CVE Published

Nov 10, 2006 - 02:07 nvd

HIGH 7.5

DescriptionCVE.org

Multiple SQL injection vulnerabilities in Abarcar Realty Portal allow remote attackers to execute arbitrary SQL commands via the (1) neid parameter to newsdetails.php, or the (2) slid parameter to slistl.php. NOTE: the cat vector is already covered by CVE-2006-2853. NOTE: the vendor has notified CVE that the current version only creates static pages, and that slistl.php/slid never existed in any version

AnalysisAI

SQL injection vulnerability affecting Abarcar Realty Portal versions 5.1.5 and 6.0.1, allowing unauthenticated remote attackers to execute arbitrary SQL commands via the 'neid' parameter in newsdetails.php. With a publicly available proof-of-concept exploit and a high EPSS score of 2.69% (86th percentile), this vulnerability poses significant risk despite vendor claims that slistl.php/slid never existed and current versions only generate static pages.

Technical ContextAI

This is a classic SQL injection vulnerability (CWE-89) in PHP-based real estate portal software. The affected products are cpe:2.3:a:abarcar:abarcar_realty_portal:5.1.5 and cpe:2.3:a:abarcar:abarcar_realty_portal:6.0.1. The vulnerability occurs when user-supplied input in the 'neid' parameter to newsdetails.php is not properly sanitized before being used in SQL queries, allowing attackers to inject malicious SQL commands. The vendor disputes part of the vulnerability report, stating that slistl.php/slid never existed in any version.

RemediationAI

No specific patch information is available in the provided references. The vendor's statement about current versions using only static pages suggests upgrading to the latest version may mitigate the risk. As immediate mitigation: 1) Implement input validation and parameterized queries for any dynamic components, 2) Apply web application firewall rules to filter SQL injection attempts, 3) Consider migrating to the vendor's static page generation model if available. Review Secunia advisory 22792 and vendor communications for updates.