PT-2005-4357 · Php · Php Icalendar+4

Robin Verton · Publicado 2005-11-16 · Atualizado 2016-10-18 · CVE-2005-3571

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions PHPCalendar version 1.0 PHPClique version 1.0 PHPCurrently version 2.0 PHPFanBase versions 2.1 through 2.2 PHPQuotes version 1.0

Description The issue allows remote attackers to include arbitrary local files via the siteurl parameter when register globals is enabled.

Recommendations For PHPCalendar version 1.0, consider disabling the siteurl parameter until a patch is available. For PHPClique version 1.0, restrict access to the vulnerable module to minimize the risk of exploitation. For PHPCurrently version 2.0, avoid using the siteurl parameter in the affected API endpoint until the issue is resolved. For PHPFanBase versions 2.1 through 2.2, as a temporary workaround, consider disabling the functionality that uses the siteurl parameter. For PHPQuotes version 1.0, restrict the use of the siteurl parameter to prevent arbitrary file inclusion.

Exploit

Correção

Code Injection

Enumeração de Fraquezas

CWE-94

Identificadores relacionados

CVE-2005-3571

Produtos afetados

Php Icalendar

Phpclique

Phpcurrently

Phpfanbase

Phpquotes

Referências · 9

• 🔥 https://exploit-db.com/exploits/26505 · Exploit
• http://marc.info/?l=bugtraq&m=113199214723444&w=2 · Nota
• http://secunia.com/advisories/17542 · Aviso do Fabricante
• http://securityfocus.com/bid/15417 · Nota
• http://securityreason.com/securityalert/176 · Nota
• http://securityfocus.com/bid/21664 · Nota
• http://securitytracker.com/id?1015206 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2005-3571 · Nota de Segurança
• http://vupen.com/english/advisories/2005/2402 · Aviso do Fabricante