PT-2006-1248 · Myphp · Myphpim

Aliaksandr Hartsuyeu · Publicado 2006-01-11 · Atualizado 2018-10-19 · CVE-2006-0169

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions MyPhPim version 01.05

Description The issue allows remote attackers to execute arbitrary PHP code by uploading files without restrictions. This is achieved via the pdbfile variable, and then directly accessing those files from the uploads directory.

Recommendations For MyPhPim version 01.05, restrict uploaded files to prevent remote attackers from executing arbitrary PHP code. As a temporary workaround, consider disabling file uploads until a patch is available. Restrict access to the uploads directory to minimize the risk of exploitation. Avoid using the pdbfile variable in the affected addresses.php3 file until the issue is resolved.

Exploit

Correção

Identificadores relacionados

CVE-2006-0169

Produtos afetados

Myphpim

Referências · 7

• 🔥 http://evuln.com/vulns/23/summary.html · Exploit
• http://securityfocus.com/bid/16208 · Nota
• http://securityfocus.com/archive/1/421626/100/0/threaded · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2006-0169 · Nota de Segurança
• https://exchange.xforce.ibmcloud.com/vulnerabilities/24070 · Nota
• http://vupen.com/english/advisories/2006/0147 · Nota
• http://secunia.com/advisories/18399 · Aviso do Fabricante