PT-2006-1319 · Phpxplorer · Phpxplorer

Oriol Torrent Santiago · Publicado 2006-01-18 · Atualizado 2024-08-07 · CVE-2006-0244

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions phpXplorer version 0.9.33

Description A directory traversal issue in workspaces.php allows remote attackers to include arbitrary files via a .. (dot dot) and trailing null byte (%00) in the sShare parameter. However, it is claimed that this functionality is supported by phpXplorer for uploading PHP files and does not cross privilege boundaries due to the PHP functionality allowing read access outside the web root.

Recommendations For phpXplorer version 0.9.33, consider restricting access to the sShare parameter in the workspaces.php file to minimize the risk of exploitation. Additionally, review the upload functionality to ensure it does not introduce security risks.

Exploit

Correção

Identificadores relacionados

CVE-2006-0244

Produtos afetados

Phpxplorer

Referências · 11

• 🔥 https://exploit-db.com/exploits/27097 · Exploit
• 🔥 http://arrelnet.com/advisories/adv20060116.html · Exploit
• 🔥 http://securityfocus.com/bid/16263 · Exploit
• http://secunia.com/advisories/18518 · Aviso do Fabricante
• http://securityfocus.com/archive/1/421997/100/0/threaded · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/39982 · Nota
• http://vupen.com/english/advisories/2006/0232 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2006-0244 · Nota de Segurança
• http://securityfocus.com/archive/1/422158/100/0/threaded · Nota
• https://t.me/cvenotify/89749 · Publicação no Telegram
• http://securityreason.com/securityalert/353 · Nota