PT-2006-3795 · Bookmark4U · Bookmark4U

Selfar2002 · Publicado 2006-06-07 · Atualizado 2018-10-18 · CVE-2006-2877

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Bookmark4U versions 2.0.0 and earlier

Description A remote file inclusion issue allows remote attackers to include arbitrary PHP files via the include prefix parameter in several PHP files, including (1) inc/dbase.php, (2) inc/config.php, (3) inc/common.php, and (4) inc/function.php. However, it has been reported that the inc directory is protected by a .htaccess file, which limits the applicability of this issue to certain environments or configurations.

Recommendations For Bookmark4U versions 2.0.0 and earlier, consider restricting access to the include prefix parameter in the affected PHP files until a patch is available. As a temporary workaround, restrict access to the inc directory by reinforcing the .htaccess file protection or applying alternative access control measures to minimize the risk of exploitation.

Exploit

Correção

Identificadores relacionados

CVE-2006-2877

Produtos afetados

Bookmark4U

Referências · 16

• 🔥 https://exploit-db.com/exploits/27974 · Exploit
• 🔥 https://exploit-db.com/exploits/27973 · Exploit
• 🔥 https://exploit-db.com/exploits/27976 · Exploit
• 🔥 https://exploit-db.com/exploits/27975 · Exploit
• http://securityfocus.com/bid/18281 · Nota
• http://securityreason.com/securityalert/1058 · Nota
• http://osvdb.org/26600 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/26933 · Nota
• http://secunia.com/advisories/19758 · Nota
• http://osvdb.org/26602 · Nota
• http://osvdb.org/26601 · Nota
• http://securitytracker.com/id?1016224 · Nota
• http://securityfocus.com/archive/1/436027/100/0/threaded · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2006-2877 · Nota de Segurança
• http://securityfocus.com/archive/1/435964/100/0/threaded · Nota