PT-2006-1927 · Noah · Noah'S Classifieds

Publicado 2006-02-24 · Atualizado 2018-10-18 · CVE-2006-0881

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Noah's Classifieds version 1.3

Description The issue allows remote attackers to include arbitrary PHP files due to multiple PHP remote file include vulnerabilities in gorum/gorumlib.php. This is possible when register globals is enabled, and it can be exploited via the upperTemplate and lowerTemplate parameters. For example, an attacker can use the lowerTemplate parameter to include arbitrary PHP files in index.php.

Recommendations For Noah's Classifieds version 1.3, consider disabling the register globals setting to prevent exploitation. Additionally, restrict access to the upperTemplate and lowerTemplate parameters in gorum/gorumlib.php to minimize the risk of arbitrary PHP file inclusion.

Exploit

Correção

Identificadores relacionados

CVE-2006-0881

Produtos afetados

Noah'S Classifieds

Referências · 8

• 🔥 http://kapda.ir/advisory-268.html · Exploit
• 🔥 https://exploit-db.com/exploits/27262 · Exploit
• 🔥 http://securityfocus.com/bid/16780 · Exploit
• http://securityfocus.com/archive/1/425783/100/0/threaded · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/24899 · Nota
• http://securitytracker.com/id?1015667 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2006-0881 · Nota de Segurança
• http://vupen.com/english/advisories/2006/0703 · Nota