PT-2006-2176 · Owl · Owl Intranet Engine

Rgod · Publicado 2006-03-10 · Atualizado 2017-10-19 · CVE-2006-1149

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions OWL Intranet Engine version 0.82

Description The issue allows remote attackers to include arbitrary files via a URL in the xrms file root parameter, which is not initialized before use, when register globals is enabled. This can be exploited by providing a malicious URL as the xrms file root parameter.

Recommendations For OWL Intranet Engine version 0.82, consider disabling the register globals setting to prevent exploitation. Additionally, restrict access to the lib/OWL API.php file to minimize the risk of arbitrary file inclusion. Avoid using the xrms file root parameter until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Identificadores relacionados

CVE-2006-1149

Produtos afetados

Owl Intranet Engine

Referências · 8

• 🔥 https://exploit-db.com/exploits/1561 · Exploit
• 🔥 http://osvdb.org/23734 · Exploit
• 🔥 http://secunia.com/advisories/19142 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2006-1149 · Nota de Segurança
• https://exchange.xforce.ibmcloud.com/vulnerabilities/25082 · Nota
• http://vupen.com/english/advisories/2006/0868 · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-1149 · Nota
• http://securityfocus.com/bid/17021 · Nota