PT-2006-3474 · Phpbazar · Phpbazar

Publicado 2006-05-22 · Atualizado 2018-10-18 · CVE-2006-2527

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions phpBazar versions 2.1.0 and earlier

Description The issue allows remote attackers to bypass the authentication process and gain unauthorized access to the administrative section. This is achieved by setting the action parameter to "edit member" and the value parameter to 1 in the "admin/admin.php" endpoint.

Recommendations For phpBazar versions 2.1.0 and earlier, as a temporary workaround, consider restricting access to the "admin/admin.php" endpoint until a patch is available. Avoid using the action parameter set to "edit member" and the value parameter set to 1 in this endpoint to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Identificadores relacionados

CVE-2006-2527

Produtos afetados

Phpbazar

Referências · 9

• 🔥 https://exploit-db.com/exploits/1804 · Exploit
• http://vupen.com/english/advisories/2006/1890 · Nota
• http://securityfocus.com/archive/1/434558/100/0/threaded · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/26617 · Nota
• http://secunia.com/advisories/20198 · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-2527 · Nota
• http://securityfocus.com/bid/18053 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2006-2527 · Nota de Segurança
• http://osvdb.org/25701 · Nota