PT-2006-2608 · Squery · Osquery

Uid0 · Publicado 2006-04-04 · Atualizado 2018-10-18 · CVE-2006-1610

Positive Technologies (AI Summary)

CVSS v2.0

5.1

Média

Vetor base

AV:N/AC:H/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions: SQuery versions 4.5 and earlier

Description: The issue allows remote attackers to execute arbitrary PHP code via a URL in the libpath parameter. This occurs when register globals is disabled.

Recommendations: For SQuery versions 4.5 and earlier, consider disabling the libpath parameter or restricting its use until a patch is available. Additionally, enabling register globals may prevent the issue, but this should be done with caution due to potential security implications of enabling this setting. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Code Injection

Enumeração de Fraquezas

CWE-94

Identificadores relacionados

CVE-2006-1610

Produtos afetados

Osquery

Referências · 8

• 🔥 https://exploit-db.com/exploits/1629 · Exploit
• 🔥 http://securityfocus.com/bid/17434 · Exploit
• http://securityfocus.com/archive/1/429611/100/0/threaded · Nota
• http://osvdb.org/24400 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/25605 · Nota
• http://vupen.com/english/advisories/2006/1204 · Aviso do Fabricante
• http://secunia.com/advisories/19482 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2006-1610 · Nota de Segurança