PT-2006-2114 · Php · Php-Stats

Publicado 2006-03-09 · Atualizado 2018-10-18 · CVE-2006-1087

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Média

Vetor base

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions PHP-Stats versions 0.1.9.1 and earlier

Description A direct static code injection issue exists in the modify config action in admin.php, allowing remote authenticated administrators to execute arbitrary PHP code via the option new[compatibility mode] parameter. This parameter is not filtered before being stored in config.php. Additionally, this issue can be exploited by remote unauthenticated attackers when combined with an authentication bypass vulnerability related to the option[admin pass] parameter.

Recommendations For PHP-Stats versions 0.1.9.1 and earlier, update to a version that fixes this issue. As a temporary workaround, consider restricting access to the modify config action in admin.php to prevent exploitation. Avoid using the option new[compatibility mode] parameter in the affected admin.php until the issue is resolved.

Exploit

Correção

Identificadores relacionados

CVE-2006-1087

Produtos afetados

Php-Stats

Referências · 9

• 🔥 http://retrogod.altervista.org/php_stats_0191_adv.html · Exploit
• http://securityfocus.com/archive/1/426762/100/0/threaded · Nota
• http://securityfocus.com/bid/16963 · Nota
• http://securityfocus.com/archive/1/428614/100/0/threaded · Nota
• http://secunia.com/advisories/19116 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2006-1087 · Nota de Segurança
• http://phpstats.net/forum/viewtopic.php?t=140 · Nota
• http://vupen.com/english/advisories/2006/0822 · Nota
• http://securityfocus.com/archive/1/429145/100/0/threaded · Nota