PT-2006-3541 · Artmedic · Artmedic Newsletter

C.Schmitz · Publicado 2006-05-26 · Atualizado 2018-10-18 · CVE-2006-2608

Positive Technologies (AI Summary)

CVSS v2.0

5.1

Média

Vetor base

AV:N/AC:H/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions artmedic newsletter version 4.1

Description The issue allows remote attackers to modify arbitrary files and execute arbitrary PHP code when register globals is enabled. This is achieved by exploiting the logfile parameter in a direct request to "log.php", which redefines the $logfile variable to an attacker-controlled value. For example, an attacker can inject PHP code into "info.php".

Recommendations For artmedic newsletter version 4.1, consider disabling the register globals setting to prevent exploitation. As a temporary workaround, restrict access to the "log.php" file to minimize the risk of arbitrary file modification and PHP code execution. Avoid using the logfile parameter in direct requests to "log.php" until the issue is resolved.

Exploit

Correção

Identificadores relacionados

CVE-2006-2608

Produtos afetados

Artmedic Newsletter

Referências · 8

• 🔥 https://exploit-db.com/exploits/27900 · Exploit
• 🔥 http://securityfocus.com/bid/18047 · Exploit
• http://securityreason.com/securityalert/957 · Nota
• http://secunia.com/advisories/20204 · Aviso do Fabricante
• http://vupen.com/english/advisories/2006/1930 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/26597 · Nota
• http://securityfocus.com/archive/1/434738/100/0/threaded · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2006-2608 · Nota de Segurança