PT-2006-1836 · Plaino · Plaino Wimpy Mp3 Player

Publicado 2006-02-19 · Atualizado 2017-07-20 · CVE-2006-0787

Positive Technologies (AI Summary)

CVSS v2.0

4.0

Média

Vetor base

AV:N/AC:H/Au:N/C:N/I:P/A:P

Name of the Vulnerable Software and Affected Versions Plaino Wimpy MP3 Player versions 5.2 and earlier

Description The issue allows remote attackers to insert arbitrary strings into trackme.txt via the trackFile, trackArtist, and trackTitle parameters. This can result in providing false information about songs, occupying excessive disk space with very long parameter values, and potentially storing executable code that might be invoked through a different vulnerability.

Recommendations For versions 5.2 and earlier, consider restricting access to the wimpy trackplays.php file to minimize the risk of exploitation. As a temporary workaround, avoid using the trackFile, trackArtist, and trackTitle parameters in the affected API endpoint until the issue is resolved.

Exploit

Correção

Identificadores relacionados

CVE-2006-0787

Produtos afetados

Plaino Wimpy Mp3 Player

Referências · 6

• 🔥 http://securityfocus.com/bid/16696 · Exploit
• 🔥 http://xorcrew.net/xpa/XPA-WimpyMP3Player.txt · Exploit
• 🔥 https://exploit-db.com/exploits/27244 · Exploit
• http://secunia.com/advisories/18900 · Aviso do Fabricante
• https://exchange.xforce.ibmcloud.com/vulnerabilities/24770 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2006-0787 · Nota de Segurança