PT-2006-1667 · 2200Net · 2200Net Calendar System

Aliaksandr Hartsuyeu · Publicado 2006-02-09 · Atualizado 2018-10-19 · CVE-2006-0610

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions 2200net Calendar system version 1.2

Description The issue allows remote attackers to execute arbitrary SQL commands and bypass authentication. This can be achieved via two methods:

• The fm data[id] parameter to "calendar.php"
• The $ad['acc'] variable in "adminlogin.php", when gpc magic quotes is disabled.

Recommendations For 2200net Calendar system version 1.2, consider disabling the gpc magic quotes disabled feature or restricting access to "calendar.php" and "adminlogin.php" until a patch is available. Avoid using the fm data[id] parameter in "calendar.php" and the $ad['acc'] variable in "adminlogin.php" to minimize the risk of exploitation.

Correção

Identificadores relacionados

CVE-2006-0610

Produtos afetados

2200Net Calendar System

Referências · 11

• http://secunia.com/advisories/18781 · Nota
• http://osvdb.org/23037 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/24483 · Nota
• http://securityfocus.com/bid/16569 · Nota
• http://osvdb.org/23038 · Nota
• http://securityfocus.com/archive/1/425094/100/0/threaded · Nota
• http://marc.info/?l=bugtraq&m=114003781801861&w=2 · Nota
• http://evuln.com/vulns/62/summary.html · Aviso do Fabricante
• https://exchange.xforce.ibmcloud.com/vulnerabilities/24484 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2006-0610 · Nota de Segurança
• http://vupen.com/english/advisories/2006/0486 · Nota