PT-2006-1512 · Phpclanwebsite · Phpclanwebsite

Publicado 2006-01-26 · Atualizado 2018-10-19 · CVE-2006-0445

Positive Technologies (AI Summary)

CVSS v2.0

4.0

Média

Vetor base

AV:N/AC:L/Au:S/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Phpclanwebsite version 1.23.1

Description The issue allows remote authenticated users to obtain the installation path by specifying an invalid file name to the "uploader page", which can display the full path of "uploader.php". This might be the result of a file inclusion vulnerability.

Recommendations For Phpclanwebsite version 1.23.1, as a temporary workaround, consider restricting access to the uploader page until a patch is available. Avoid using invalid file names in the uploader page to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this issue.

Exploit

Correção

Identificadores relacionados

CVE-2006-0445

Produtos afetados

Phpclanwebsite

Referências · 5

• 🔥 http://h4cky0u.org/advisories/HYSA-2006-002-phpclan.txt · Exploit
• http://osvdb.org/22721 · Nota
• http://securityfocus.com/bid/16391 · Nota
• http://securityfocus.com/archive/1/423145/100/0/threaded · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2006-0445 · Nota de Segurança