PT-2005-4343 · Php · Phpkit

Publicado 2005-11-16 · Atualizado 2017-07-11 · CVE-2005-3554

Positive Technologies (AI Summary)

CVSS v2.0

5.1

Média

Vetor base

AV:N/AC:H/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions PHPKIT versions 1.6.1 R2 and earlier

Description The issue concerns multiple eval injection vulnerabilities in the help function of PHPKIT. When register globals is enabled, remote attackers can execute arbitrary code on the server via unknown attack vectors involving uninitialized variables.

Recommendations For PHPKIT versions 1.6.1 R2 and earlier, disable the register globals setting to prevent exploitation of this issue. Additionally, consider disabling the help function until a patch is available.

Exploit

Correção

RCE

Code Injection

Enumeração de Fraquezas

CWE-94

Identificadores relacionados

CVE-2005-3554

Produtos afetados

Phpkit

Referências · 10

• 🔥 http://hardened-php.net/advisory_212005.80.html · Exploit
• http://secunia.com/advisories/17479 · Aviso do Fabricante
• http://osvdb.org/20563 · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-3554 · Nota
• http://securitytracker.com/id?1015167 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2005-3554 · Nota de Segurança
• http://securityfocus.com/bid/15354 · Nota
• http://vupen.com/english/advisories/2005/2344 · Aviso do Fabricante
• https://exchange.xforce.ibmcloud.com/vulnerabilities/23015 · Nota
• http://cert.uni-stuttgart.de/archive/bugtraq/2005/11/msg00110.html · Nota