PT-2006-3606 · Actionapps · Actionapps

Kacper · Publicado 2006-05-31 · Atualizado 2017-10-19 · CVE-2006-2686

Positive Technologies (AI Summary)

CVSS v2.0

6.4

Média

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions ActionApps version 2.8.1

Description The issue allows remote attackers to execute arbitrary PHP code via a URL in the GLOBALS[AA INC PATH] parameter in multiple files, including cached.php3, cron.php3, discussion.php3, filldisc.php3, filler.php3, fillform.php3, go.php3, hiercons.php3, jsview.php3, live checkbox.php3, offline.php3, post2shtml.php3, search.php3, slice.php3, sql update.php3, view.php3, and multiple files in the admin/, includes, and modules/ folders.

Recommendations For ActionApps version 2.8.1, consider restricting access to the GLOBALS[AA INC PATH] parameter to minimize the risk of exploitation. As a temporary workaround, avoid using the GLOBALS[AA INC PATH] parameter in the affected files until a patch is available. At the moment, there is no information about a newer version that contains a fix for this issue.

Exploit

Correção

Code Injection

Enumeração de Fraquezas

CWE-94

Identificadores relacionados

CVE-2006-2686

Produtos afetados

Actionapps

Referências · 62

• 🔥 https://exploit-db.com/exploits/1829 · Exploit
• 🔥 http://secunia.com/advisories/20299 · Exploit
• http://osvdb.org/27266 · Nota
• http://osvdb.org/27292 · Nota
• http://osvdb.org/27284 · Nota
• http://osvdb.org/27264 · Nota
• http://osvdb.org/27280 · Nota
• http://osvdb.org/27254 · Nota
• http://osvdb.org/27302 · Nota
• http://osvdb.org/27290 · Nota
• http://osvdb.org/27303 · Nota
• http://osvdb.org/27295 · Nota
• http://osvdb.org/27281 · Nota
• http://osvdb.org/27296 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2006-2686 · Nota de Segurança