PT-2006-3118 · Php · Php Newsfeed

Aliaksandr Hartsuyeu · Publicado 2006-05-02 · Atualizado 2017-07-20 · CVE-2006-2139

Positive Technologies (AI Summary)

CVSS v2.0

6.4

Média

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions PHP Newsfeed version 20040723

Description The issue allows remote attackers to execute arbitrary SQL commands. This can be achieved via various parameters to different PHP files, including the name parameter to 'deltables.php', select, header, url, source, or time parameters to 'manualsubmit.php', num parameter to 'delete.php', or tablename parameter to 'searchnews.php'.

Recommendations For PHP Newsfeed version 20040723, consider restricting access to the vulnerable parameters, such as name, select, header, url, source, time, num, and tablename, in the respective PHP files until a patch is available. As a temporary workaround, avoid using these parameters in the affected API endpoints.

Correção

Identificadores relacionados

CVE-2006-2139

Produtos afetados

Php Newsfeed

Referências · 10

• https://nvd.nist.gov/vuln/detail/CVE-2006-2139 · Nota de Segurança
• http://evuln.com/vulns/129/summary.html · Nota
• http://secunia.com/advisories/19904 · Aviso do Fabricante
• http://osvdb.org/25133 · Nota
• http://vupen.com/english/advisories/2006/1574 · Nota
• http://osvdb.org/25135 · Nota
• http://osvdb.org/25134 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/26205 · Nota
• http://osvdb.org/25132 · Nota
• http://securityfocus.com/bid/17757 · Nota