PT-2006-4000 · Apache+1 · Mod Mime+2

Rgod · Publicado 2006-06-21 · Atualizado 2018-10-18 · CVE-2006-3102

Positive Technologies (AI Summary)

CVSS v2.0

5.1

Média

Vetor base

AV:N/AC:H/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Bitweaver version 1.3

Description A race condition exists in the articles/BitArticle.php file of Bitweaver, allowing remote attackers to execute arbitrary PHP code when run on Apache with the mod mime extension. This is achieved by uploading files with double extensions, which are temporarily stored under the webroot in the temp/articles directory.

Recommendations For Bitweaver version 1.3, consider restricting access to the temp/articles directory or implementing validation to prevent uploads of files with double extensions as a temporary workaround until a patch is available.

Exploit

Correção

Identificadores relacionados

CVE-2006-3102

Produtos afetados

Apache

Bitweaver

Mod Mime

Referências · 12

• 🔥 http://secunia.com/advisories/20695 · Exploit
• 🔥 https://exploit-db.com/exploits/1918 · Exploit
• 🔥 http://retrogod.altervista.org/bitweaver_13_xpl.html · Exploit
• http://bitweaver.org/articles/45 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/27215 · Nota
• http://securityreason.com/securityalert/1115 · Nota
• http://securityfocus.com/archive/1/437491/100/0/threaded · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2006-3102 · Nota de Segurança
• http://sourceforge.net/project/shownotes.php?release_id=336854&group_id=141358 · Nota
• http://vupen.com/english/advisories/2006/2405 · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3102 · Nota
• http://osvdb.org/26587 · Nota