PT-2006-3689 · Pppblog · Pppblog

Rgod · Publicado 2006-06-02 · Atualizado 2018-10-18 · CVE-2006-2770

Positive Technologies (AI Summary)

CVSS v2.0

5.4

Média

Vetor base

AV:N/AC:H/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions pppBLOG versions 0.3.8 and earlier

Description The issue allows remote attackers to read arbitrary files due to a directory traversal vulnerability in the randompic.php file when register globals is enabled. This can be achieved by using a .. (dot dot) sequence in an index of the file array parameter.

Recommendations For pppBLOG versions 0.3.8 and earlier, consider disabling the register globals setting to mitigate the risk of exploitation. As a temporary workaround, restrict access to the randompic.php file until a patch is available. Avoid using the file array parameter in the affected file until the issue is resolved.

Exploit

Correção

Identificadores relacionados

CVE-2006-2770

Produtos afetados

Pppblog

Referências · 11

• 🔥 http://retrogod.altervista.org/pppblog_038_xpl.html · Exploit
• 🔥 https://exploit-db.com/exploits/6972 · Exploit
• 🔥 https://exploit-db.com/exploits/1853 · Exploit
• 🔥 http://securityfocus.com/bid/18189 · Exploit
• https://exchange.xforce.ibmcloud.com/vulnerabilities/26969 · Nota
• http://vupen.com/english/advisories/2006/2085 · Nota
• http://secunia.com/advisories/20375 · Aviso do Fabricante
• http://securitytracker.com/id?1016198 · Nota
• http://securityfocus.com/archive/1/435406/100/0/threaded · Nota
• http://securityreason.com/securityalert/1015 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2006-2770 · Nota de Segurança