PT-2006-1835 · Php · Phpkit

Rgod · Publicado 2006-02-19 · Atualizado 2018-10-18 · CVE-2006-0786

Positive Technologies (AI Summary)

CVSS v2.0

5.1

Média

Vetor base

AV:N/AC:H/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions PHPKIT versions 1.6.1 Release 2 and earlier

Description The issue allows remote attackers to conduct PHP remote file include attacks via a path parameter. This can be achieved by specifying a (1) UNC share or (2) ftps URL, which bypasses the check for "http://", "ftp://", and "https://" URLs. This is possible when allow url fopen is enabled.

Recommendations For PHPKIT versions 1.6.1 Release 2 and earlier, consider disabling the allow url fopen setting to prevent remote file inclusion attacks. Additionally, restrict access to the include.php file to minimize the risk of exploitation.

Exploit

Correção

Identificadores relacionados

CVE-2006-0786

Produtos afetados

Phpkit

Referências · 7

• 🔥 https://exploit-db.com/exploits/1501 · Exploit
• 🔥 http://retrogod.altervista.org/phpkit_161r2_incl_xpl.html · Exploit
• http://securityfocus.com/archive/1/425196/100/0/threaded · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2006-0786 · Nota de Segurança
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-0786 · Nota
• http://securityreason.com/securityalert/445 · Nota
• http://securitytracker.com/id?1015640 · Nota