PT-2006-2989 · Clansys · Clansys

Mustafa Can Bjorn Ipekci + 1 · Publicado 2006-04-25 · Atualizado 2018-10-18 · CVE-2006-2005

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions ClanSys version 1.1

Description The issue allows remote attackers to execute arbitrary PHP code via PHP code in the page parameter. This is achieved by injecting an "include" statement into the eval statement, demonstrating the eval injection vulnerability. It's worth noting that some sources describe this issue as file inclusion, but the primary concern is the eval injection itself.

Recommendations For ClanSys version 1.1, consider disabling the eval statement in index.php to prevent arbitrary PHP code execution until a patch is available. Restrict access to the page parameter to minimize the risk of exploitation.

Exploit

Correção

Identificadores relacionados

CVE-2006-2005

Produtos afetados

Clansys

Referências · 9

• 🔥 http://nukedx.com/?getxpl=29 · Exploit
• 🔥 https://exploit-db.com/exploits/1710 · Exploit
• 🔥 http://securitytracker.com/id?1015988 · Exploit
• http://osvdb.org/25083 · Nota
• http://securityfocus.com/bid/17660 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2006-2005 · Nota de Segurança
• http://securityreason.com/securityalert/782 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/25976 · Nota
• http://securityfocus.com/archive/1/431873/100/0/threaded · Nota