PT-2006-1741 · Docmgr · Docmgr

Rgod · Publicado 2006-02-15 · Atualizado 2018-10-19 · CVE-2006-0687

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions DocMGR version 0.54.2

Description The issue concerns the process.php file in DocMGR, where the $siteModInfo variable is not initialized when a direct request is made. This allows remote attackers to include arbitrary local files or possibly remote files by modifying the includeModule and siteModInfo variable.

Recommendations For DocMGR version 0.54.2, ensure the $siteModInfo variable is properly initialized in the process.php file to prevent arbitrary file inclusion. As a temporary workaround, consider restricting access to the process.php file or validating user input to minimize the risk of exploitation.

Exploit

Correção

Identificadores relacionados

CVE-2006-0687

Produtos afetados

Docmgr

Referências · 9

• 🔥 http://retrogod.altervista.org/docmgr_0542_incl_xpl.html · Exploit
• 🔥 https://exploit-db.com/exploits/1491 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2006-0687 · Nota de Segurança
• https://exchange.xforce.ibmcloud.com/vulnerabilities/24694 · Nota
• http://vupen.com/english/advisories/2006/0544 · Nota
• http://securityfocus.com/bid/16601 · Nota
• http://secunia.com/advisories/18803 · Aviso do Fabricante
• http://securityfocus.com/archive/1/424818/100/0/threaded · Nota
• http://securityreason.com/securityalert/428 · Nota