PT-2006-2753 · Blur6Ex · Blur6Ex

Steven M. Christey · Publicado 2006-04-13 · Atualizado 2018-10-18 · CVE-2006-1762

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions blur6ex version 0.3.452

Description The issue is a directory traversal vulnerability in the index.php file, which allows remote attackers to include arbitrary files via the shard parameter. This can be exploited to produce resultant XSS when the parameter has XSS manipulations, and path disclosure with other invalid values.

Recommendations For blur6ex version 0.3.452, consider restricting access to the shard parameter in the index.php file to minimize the risk of exploitation. As a temporary workaround, avoid using the shard parameter with potentially malicious input until a fix is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Identificadores relacionados

CVE-2006-1762

Produtos afetados

Blur6Ex

Referências · 7

• 🔥 http://securityfocus.com/bid/17465 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2006-1762 · Nota de Segurança
• http://securityfocus.com/archive/1/491565/100/0/threaded · Nota
• http://securityfocus.com/archive/1/430607/100/0/threaded · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/25758 · Nota
• http://attrition.org/pipermail/vim/2006-April/000691.html · Nota
• http://securityfocus.com/archive/1/430885/100/0/threaded · Nota