PT-2006-3871 · Xtreme Scripts · Xtreme Scripts Download Manager

Black Code + 1 · Publicado 2006-06-12 · Atualizado 2018-10-18 · CVE-2006-2964

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Xtreme Scripts Download Manager version 1.0

Description The issue allows remote attackers to execute arbitrary PHP code via a URL in the root parameter in several PHP files, including "download.php", "manager.php", "admin/scripts/category.php", "includes/add allow.php", "admin/index.php", and "admin/admin/login.php".

Recommendations For Xtreme Scripts Download Manager version 1.0, consider disabling the root parameter in the affected PHP files until a patch is available. Restrict access to the vulnerable PHP files to minimize the risk of exploitation. Avoid using the root parameter in the affected API endpoints until the issue is resolved.

Exploit

Correção

Identificadores relacionados

CVE-2006-2964

Produtos afetados

Xtreme Scripts Download Manager

Referências · 11

• 🔥 http://osvdb.org/26644 · Exploit
• 🔥 http://osvdb.org/26645 · Exploit
• 🔥 http://osvdb.org/26646 · Exploit
• 🔥 http://osvdb.org/26643 · Exploit
• http://osvdb.org/26647 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/26961 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2006-2964 · Nota de Segurança
• http://osvdb.org/26648 · Nota
• http://securityreason.com/securityalert/1072 · Nota
• http://securityfocus.com/archive/1/436107/100/0/threaded · Nota
• http://securityfocus.com/archive/1/436104/100/0/threaded · Nota