CVE-2006-5419: PHP remote file inclusion vulnerability in client.php in University of Glasgow Specimen Image Database (SID...

Security readout for executives and security teams

CVE-2006-5419 affects the University of Glasgow Specimen Image Database client.php. If the old PHP register_globals setting is enabled, an attacker may supply a remote file location through the dir parameter and cause arbitrary PHP code execution. Exposure is most likely in legacy PHP environments still hosting the SID application, especially internet-facing instances with register_globals enabled. Modern default PHP configurations are less likely to be affected, but old research, museum, or academic image database deployments should be checked. Prioritize this for legacy asset review. The business risk is remote code execution on outdated PHP applications, but evidence is limited to old public advisories and exploit publication, not confirmed current exploitation. Mitigation focus: Inventory any University of Glasgow SID deployments and locate exposed client.php files.; Ensure register_globals is disabled wherever PHP still supports or emulates it.; Restrict public access to SID until exposure and configuration are confirmed..

Prepared

Jun 29, 2026, 09:52 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.