PT-2006-3542 · Artmedic · Artmedic Newsletter

Publicado 2006-05-26 · Atualizado 2011-03-08 · CVE-2006-2609

Positive Technologies (AI Summary)

CVSS v2.0

5.1

Média

Vetor base

AV:N/AC:H/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions artmedic newsletter versions 4.1.2 and possibly other versions

Description The issue allows remote attackers to modify arbitrary files and execute arbitrary PHP code when the register globals setting is enabled. This is achieved via the email parameter to the "newsletter log.php" endpoint.

Recommendations For version 4.1.2, consider disabling the register globals setting to prevent exploitation. As a temporary workaround, restrict access to the "newsletter log.php" endpoint until a patch is available. Avoid using the email parameter in the affected endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Identificadores relacionados

CVE-2006-2609

Produtos afetados

Artmedic Newsletter

Referências · 3

• http://vupen.com/english/advisories/2006/1930 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2006-2609 · Nota de Segurança
• http://secunia.com/advisories/20204 · Aviso do Fabricante