CVE-2006-1828: SQL injection vulnerability in php121language.php in PHP121 1.4 allows remote attackers to execute arbitrary S

Q: How do I fix CVE-2006-1828?

php121 instant messenger: upgrade to newer than 1.4. Exact commands for each OS are on this page.

Q: Is CVE-2006-1828 being exploited?

CVE-2006-1828 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.

Q: What does CVE-2006-1828 affect?

CVE-2006-1828 affects php121 instant messenger. Severity is medium (CVSS 5.1). SQL injection vulnerability in php121language.php in PHP121 1.4 allows remote attackers to execute arbitrary SQL commands and execute arbitrary code via the sess_username variable, as set by the php121un HTTP COOKIE parameter, which is used

Q: How urgent is CVE-2006-1828?

Priority 43/100. Public exploit reference

This month

MEDIUM 5.1UPGRADE

CVE-2006-1828 is a medium-severity flaw (CVSS 5.1) affecting php121 instant messenger. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.

SQL injection vulnerability in php121language.php in PHP121 1.4 allows remote attackers to execute arbitrary SQL commands and execute arbitrary code via the sess_username variable, as set by the php121un HTTP COOKIE parameter, which is used in multiple files including php121login.php. NOTE: the code execution occurs because the SQL query results are used in an include statement.

Why this priority

Public exploit reference

A fixed release or distro patch exists.

Risk facts

CVSS score	5.1 (Medium)
EPSS exploit chance	2.1% (top 19%)
CISA exploited list	No
Published	2006-04-19
Last modified	2026-06-16

Publisher (CNA): MITRE · Vendor: php121

Last updated 2026-06-16 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score

Am I affected?

Timeline

2006-04-19 16:06 UTCPublished CVE record published
2026-06-16 22:23 UTCUpdated Record last modified

php121 php121 instant messenger UPGRADE

Affected: <= 1.4

Fixed in: newer than 1.4

Safe to downgrade to: no unaffected older release

1. Check installed version

apt-cache policy php121-instant-messenger || rpm -q php121-instant-messenger || php121-instant-messenger --version

2. UPGRADE to newer than 1.4 (Debian / Ubuntu)

sudo apt update && sudo apt install --only-upgrade php121-instant-messenger

2. UPGRADE (RHEL / Amazon Linux / Fedora)

sudo dnf upgrade php121-instant-messenger

Note

Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.

Public exploits and detection

Public code exists for this CVE. Treat unpatched systems as at risk, and only run PoCs in a lab.

Exploit-DB: PHP121 Instant Messenger 1.4 - Remote Code Execution

Verify at the official source NVD · CVE Program · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.

Quick answers

How do I fix CVE-2006-1828?

php121 instant messenger: upgrade to newer than 1.4. Exact commands for each OS are on this page.

Is CVE-2006-1828 being exploited?

CVE-2006-1828 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.

What does CVE-2006-1828 affect?

CVE-2006-1828 affects php121 instant messenger. Severity is medium (CVSS 5.1). SQL injection vulnerability in php121language.php in PHP121 1.4 allows remote attackers to execute arbitrary SQL commands and execute arbitrary code via the sess_username variable, as set by the php121un HTTP COOKIE parameter, which is used

How urgent is CVE-2006-1828?

Priority 43/100. Public exploit reference

Software pages

PHP vulnerabilities

Related CVEs

CVE-2007-1908 MEDIUM 6.8 DOWNGRADE PHP file inclusion vulnerability in php121db.php in PHP121 Instant Messenger 2.2 allows remote attackers to ex

References

← Back to latest CVEs