PT-2006-3524 · Esyndicat · Esyndicat Directory

Publicado 2006-05-24 · Atualizado 2017-07-20 · CVE-2006-2578

Positive Technologies (AI Summary)

CVSS v2.0

5.1

Média

Vetor base

AV:N/AC:H/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions eSyndicat Directory version 1.2

Description The issue allows remote attackers to include arbitrary files and possibly execute arbitrary PHP code. This is achieved by providing a null-terminated value in the path to config parameter when register globals is enabled and magic quotes gpc is disabled.

Recommendations For eSyndicat Directory version 1.2, consider disabling the register globals setting and enabling magic quotes gpc to prevent exploitation. Additionally, restrict access to the admin/cron.php file to minimize the risk of arbitrary file inclusion and potential PHP code execution. Avoid using null-terminated values in the path to config parameter until the issue is resolved.

Correção

Identificadores relacionados

CVE-2006-2578

Produtos afetados

Esyndicat Directory

Referências · 6

• https://nvd.nist.gov/vuln/detail/CVE-2006-2578 · Nota de Segurança
• http://pridels0.blogspot.com/2006/05/esyndicat-directory-software-local.html · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/26663 · Nota
• http://secunia.com/advisories/20218 · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-2578 · Nota
• http://vupen.com/english/advisories/2006/1983 · Nota