PT-2006-2653 · Chucky A. Ivey · Chucky A. Ivey N.T.

Aliaksandr Hartsuyeu

·

Publicado

2006-04-07

·

Atualizado

2018-10-18

·

CVE-2006-1658

CVSS v2.0

7.5

Alta

VetorAV:N/AC:L/Au:N/C:P/I:P/A:P
Name of the Vulnerable Software and Affected Versions: Chucky A. Ivey N.T. version 1.1.0
Description: A direct static code injection issue exists, allowing remote administrators to insert arbitrary PHP code into the config file through the ticker.db.php script. This code is then included in other N.T. scripts, potentially leading to exploitation.
Recommendations: For Chucky A. Ivey N.T. version 1.1.0, consider restricting access to the ticker.db.php script to prevent remote administrators from injecting arbitrary PHP code until a fix is available. As a temporary workaround, avoid using the config file inclusion in other N.T. scripts to minimize the risk of exploitation.

Correção

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Identificadores relacionados

CVE-2006-1658

Produtos afetados

Chucky A. Ivey N.T.