PT-2006-3479 · Destiney · Destiney Rated Images Script

Luny · Publicado 2006-05-22 · Atualizado 2018-10-18 · CVE-2006-2532

Positive Technologies (AI Summary)

CVSS v2.0

6.4

Média

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Destiney Rated Images Script version 0.5.0

Description The issue allows remote attackers to obtain the installation path via an invalid s parameter in the stats.php file, which displays the path in an error message. Initially, it was thought to be related to SQL injection, but analysis shows the problem is due to an invalid value that prevents some variables from being set.

Recommendations For Destiney Rated Images Script version 0.5.0, consider validating and sanitizing the s parameter in the stats.php file to prevent the disclosure of the installation path. As a temporary workaround, restrict access to the stats.php file to minimize the risk of exploitation.

Correção

Identificadores relacionados

CVE-2006-2532

Produtos afetados

Destiney Rated Images Script

Referências · 4

• http://securityfocus.com/archive/1/434691/100/0/threaded · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/26603 · Nota
• http://securityreason.com/securityalert/940 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2006-2532 · Nota de Segurança