PT-2006-1685 · Dale Ray · Myquiz

Aliaksandr Hartsuyeu · Publicado 2006-02-10 · Atualizado 2018-10-19 · CVE-2006-0628

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Dale Ray MyQuiz version 1.01

Description The issue allows remote attackers to execute arbitrary commands via shell metacharacters in the URL. This is due to the improper handling of shell metacharacters as part of the PATH INFO environment variable.

Recommendations For Dale Ray MyQuiz version 1.01, consider restricting access to the myquiz.pl script until a proper fix is available, and ensure that any user input is properly sanitized to prevent the injection of shell metacharacters. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Identificadores relacionados

CVE-2006-0628

Produtos afetados

Myquiz

Referências · 12

• 🔥 http://evuln.com/vulns/57/summary.html · Exploit
• 🔥 https://exploit-db.com/exploits/1471 · Exploit
• http://osvdb.org/22925 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/24501 · Nota
• http://securityfocus.com/archive/1/424266/100/0/threaded · Nota
• http://securityfocus.com/archive/1/423921/100/0/threaded · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2006-0628 · Nota de Segurança
• http://vupen.com/english/advisories/2006/0443 · Nota
• http://attrition.org/pipermail/vim/2006-February/000537.html · Nota
• http://secunia.com/advisories/18737 · Nota
• http://corantodemo.net/coranto/viewnews.cgi?id=EpApAAAVkyirPGThSf&style=dldetails · Correção
• http://securityreason.com/securityalert/409 · Nota