PT-2006-2562 · Vbook · Vbook

Publicado 2006-03-31 · Atualizado 2018-10-18 · CVE-2006-1563

Positive Technologies (AI Summary)

CVSS v2.0

7.6

Alta

Vetor base

AV:N/AC:H/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: VBook version 2.0

Description: A direct static code injection issue in the config.php file of VBook allows remote administrators to execute arbitrary PHP code. This code is injected into the config file, which is then included in other VBook scripts.

Recommendations: For VBook version 2.0, consider restricting access to the config.php file to prevent remote administrators from injecting arbitrary PHP code until a patch is available. As a temporary workaround, limit the privileges of remote administrators to minimize the risk of exploitation.

Correção

Identificadores relacionados

CVE-2006-1563

Produtos afetados

Vbook

Referências · 7

• http://vupen.com/english/advisories/2006/1174 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2006-1563 · Nota de Segurança
• http://osvdb.org/24272 · Nota
• http://securityfocus.com/archive/1/430624/100/0/threaded · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/25522 · Nota
• http://secunia.com/advisories/19448 · Nota
• http://evuln.com/vulns/111 · Nota