PT-2005-3797 · Azdg · Azdgdatinglite

Retrogod · Publicado 2005-09-16 · Atualizado 2017-07-11 · CVE-2005-2951

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions AzDGDatingLite versions 2.1.3 and possibly earlier

Description The issue allows remote attackers to execute arbitrary PHP commands. This is achieved by using ".." sequences and "%00" (trailing null byte) characters in the l parameter, which is used in an include once statement.

Recommendations For versions 2.1.3 and possibly earlier, consider restricting access to the security.inc.php file until a patch is available. As a temporary workaround, avoid using the l parameter in the include once statement to minimize the risk of exploitation.

Exploit

Correção

Identificadores relacionados

CVE-2005-2951

Produtos afetados

Azdgdatinglite

Referências · 8

• 🔥 http://rgod.altervista.org/azdg.html · Exploit
• 🔥 http://securityfocus.com/bid/14819 · Exploit
• 🔥 https://exploit-db.com/exploits/1214 · Exploit
• http://marc.info/?l=bugtraq&m=112662698511403&w=2 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/22258 · Nota
• http://securityreason.com/securityalert/5 · Nota
• http://secunia.com/advisories/16814 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2005-2951 · Nota de Segurança