PT-2006-1871 · Geeklog · Geeklog

James Bercegay · Publicado 2006-02-21 · Atualizado 2018-10-18 · CVE-2006-0824

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Geeklog versions 1.3.11 through 1.3.11sr3 Geeklog versions 1.4.0 through 1.4.0sr0

Description The issue allows remote attackers to include arbitrary local files and execute arbitrary code. This can be achieved via absolute paths in unspecified parameters and the language cookie. For example, code execution can be demonstrated using error.log.

Recommendations For Geeklog versions 1.3.11 through 1.3.11sr3, update to version 1.3.11sr4 to resolve the issue. For Geeklog versions 1.4.0 through 1.4.0sr0, update to version 1.4.0sr1 to resolve the issue. As a temporary workaround, consider restricting access to the language cookie and unspecified parameters in lib-common.php to minimize the risk of exploitation.

Correção

Identificadores relacionados

CVE-2006-0824

Produtos afetados

Geeklog

Referências · 9

• http://securityfocus.com/archive/1/425506/100/0/threaded · Nota
• http://securityfocus.com/bid/16755 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2006-0824 · Nota de Segurança
• http://osvdb.org/23349 · Nota
• http://secunia.com/advisories/18920 · Aviso do Fabricante
• http://geeklog.net/article.php/geeklog-1.4.0sr1 · Correção
• http://vupen.com/english/advisories/2006/0661 · Nota
• http://gulftech.org/?node=research&article_id=00102-02192006 · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-0824 · Nota