PT-2006-3249 · Phpbb+2 · Phpbb+2

Botan · Publicado 2006-05-09 · Atualizado 2018-10-18 · CVE-2006-2283

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions SpiffyJr phpRaid versions 2.9.5 through 3.0.b3

Description The issue allows remote attackers to execute arbitrary PHP code via a URL in specific parameters when certain portals are enabled. This can be achieved through the phpbb root path parameter in (1) auth.php and (2) auth phpbb when the phpBB portal is enabled, and via the smf root path parameter in (3) auth.php and (4) auth SMF when the SMF portal is enabled.

Recommendations For SpiffyJr phpRaid versions 2.9.5 through 3.0.b3, consider disabling the phpBB and SMF portals until a patch is available to prevent exploitation. Restrict access to the auth.php and auth phpbb/auth SMF files to minimize the risk of arbitrary PHP code execution. Avoid using the phpbb root path and smf root path parameters in the affected API endpoints until the issue is resolved.

Exploit

Correção

Identificadores relacionados

CVE-2006-2283

Produtos afetados

Smf

Spiffyjr Phpraid

Phpbb

Referências · 10

• 🔥 http://securityfocus.com/bid/17875 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2006-2283 · Nota de Segurança
• http://secunia.com/advisories/20027 · Nota
• http://vupen.com/english/advisories/2006/1726 · Nota
• http://osvdb.org/25358 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/26346 · Nota
• http://securityfocus.com/archive/1/433252/100/0/threaded · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-2283 · Nota
• http://securityfocus.com/archive/1/433253/100/0/threaded · Nota
• http://securityreason.com/securityalert/865 · Nota