PT-2006-1776 · Reamday Enterprises · Magic News Lite

Aliaksandr Hartsuyeu · Publicado 2006-02-16 · Atualizado 2017-07-20 · CVE-2006-0724

Positive Technologies (AI Summary)

CVSS v2.0

2.6

Baixa

Vetor base

AV:N/AC:H/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Reamday Enterprises Magic News Lite version 1.2.3

Description The issue allows remote attackers to modify program behavior, potentially bypassing authentication controls, when register globals is enabled. This is achieved via modified variables, including action, passwd, admin password, new passwd, and confirm passwd, which are not initialized.

Recommendations For Reamday Enterprises Magic News Lite version 1.2.3, consider disabling the register globals setting to prevent exploitation. Additionally, as a temporary workaround, restrict access to the profile.php file until a patch is available. Avoid using the action, passwd, admin password, new passwd, and confirm passwd variables in the profile.php file until the issue is resolved.

Correção

Identificadores relacionados

CVE-2006-0724

Produtos afetados

Magic News Lite

Referências · 6

• http://securityfocus.com/bid/16665 · Nota
• http://secunia.com/advisories/18878 · Aviso do Fabricante
• http://vupen.com/english/advisories/2006/0603 · Nota
• http://evuln.com/vulns/72/summary.html · Aviso do Fabricante
• https://exchange.xforce.ibmcloud.com/vulnerabilities/24610 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2006-0724 · Nota de Segurança