PT-2006-1545 · Pmwiki · Pmwiki

Ascii + 1 · Publicado 2006-01-31 · Atualizado 2017-07-20 · CVE-2006-0479

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions PmWiki version 2.1 beta 20

Description The issue allows remote attackers to bypass protection mechanisms by setting both a GPC variable and a GLOBALS[] variable with the same name. This causes PmWiki to unset the GLOBALS[] variable but not the GPC variable, resulting in vulnerabilities such as remote file inclusion and cross-site scripting (XSS).

Recommendations For PmWiki version 2.1 beta 20, consider disabling the register globals setting to prevent exploitation. Additionally, restrict access to the pmwiki.php file to minimize the risk of remote file inclusion and cross-site scripting attacks.

Exploit

Correção

Identificadores relacionados

CVE-2006-0479

Produtos afetados

Pmwiki

Referências · 12

• 🔥 https://exploit-db.com/exploits/27147 · Exploit
• https://exchange.xforce.ibmcloud.com/vulnerabilities/24367 · Nota
• http://securityfocus.com/bid/16421 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2006-0479 · Nota de Segurança
• http://ush.it/2006/01/24/pmwiki-multiple-vulnerabilities · Aviso do Fabricante
• http://secunia.com/advisories/18634 · Aviso do Fabricante
• https://exchange.xforce.ibmcloud.com/vulnerabilities/24368 · Nota
• http://vupen.com/english/advisories/2006/0375 · Nota
• http://securitytracker.com/id?1015550 · Nota
• http://archives.neohapsis.com/archives/fulldisclosure/2006-01/0931.html · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/24366 · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-0479 · Nota