PT-2006-3408 · Sugarcrm · Sugar Suite Open Source

Rgod · Publicado 2006-05-19 · Atualizado 2018-10-18 · CVE-2006-2460

Positive Technologies (AI Summary)

CVSS v2.0

6.4

Média

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Sugar Suite Open Source (SugarCRM) versions 4.2 and earlier

Description The issue allows remote attackers to conduct attacks, such as directory traversal or PHP remote file inclusion, by modifying critical variables like $ GLOBALS and $ SESSION when register globals is enabled. This can be achieved by altering the GLOBALS[sugarEntry] parameter.

Recommendations For Sugar Suite Open Source (SugarCRM) versions 4.2 and earlier, disable the register globals setting to prevent modification of critical variables. As a temporary workaround, consider restricting access to sensitive parameters like GLOBALS[sugarEntry] until a more permanent solution is applied.

Exploit

Correção

Identificadores relacionados

CVE-2006-2460

Produtos afetados

Sugar Suite Open Source

Referências · 12

• 🔥 https://exploit-db.com/exploits/1785 · Exploit
• 🔥 http://securitytracker.com/id?1016087 · Exploit
• 🔥 http://retrogod.altervista.org/sugar_suite_42_incl_xpl.html · Exploit
• 🔥 http://securityfocus.com/bid/17987 · Exploit
• http://secunia.com/advisories/20072 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2006-2460 · Nota de Segurança
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-2460 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/26451 · Nota
• http://securityreason.com/securityalert/921 · Nota
• http://vupen.com/english/advisories/2006/1791 · Nota
• http://osvdb.org/25532 · Nota
• http://securityfocus.com/archive/1/434009/100/0/threaded · Nota