PT-2006-3477 · Snitz Forums · Avatar Mod

Publicado 2006-05-22 · Atualizado 2018-10-18 · CVE-2006-2530

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Avatar MOD versions 1.3 and possibly other versions for Snitz Forums 3.4

Description The issue allows remote attackers to bypass file type checks and upload arbitrary files via a null byte in the file name.

Recommendations For Avatar MOD version 1.3, consider restricting file uploads or validating file names to prevent null byte injection until a patch is available. For other possibly affected versions of Avatar MOD, restrict file uploads or validate file names to prevent null byte injection until a patch is available.

Exploit

Correção

Enumeração de Fraquezas

CWE-264

Identificadores relacionados

CVE-2006-2530

Produtos afetados

Avatar Mod

Referências · 8

• 🔥 http://codescan.com/Advisories/CodeScanLabs_AvatarMod.html · Exploit
• http://secunia.com/advisories/20148 · Aviso do Fabricante
• http://securityfocus.com/bid/18014 · Nota
• http://security-assessment.com/Whitepapers/0x00_vs_ASP_File_Uploads.pdf · Nota
• http://vupen.com/english/advisories/2006/1854 · Nota
• http://securityfocus.com/archive/1/434366/100/0/threaded · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/26546 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2006-2530 · Nota de Segurança