PT-2006-4014 · Phpraid · Phpraid

Publicado 2006-06-29 · Atualizado 2017-07-20 · CVE-2006-3116

Positive Technologies (AI Summary)

CVSS v2.0

5.1

Média

Vetor base

AV:N/AC:H/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions phpRaid versions 3.0.4 through 3.0.5

Description The issue allows remote attackers to execute arbitrary code via a URL in the phpraid dir parameter to various PHP files, including 'configuration.php', 'guilds.php', 'index.php', 'locations.php', 'login.php', 'lua output.php', 'permissions.php', 'profile.php', 'raids.php', 'register.php', 'roster.php', and 'view.php'.

Recommendations For phpRaid version 3.0.4, update to a version that fixes the remote file inclusion issue. For phpRaid version 3.0.5, update to a version that fixes the remote file inclusion issue. As a temporary workaround, consider restricting access to the phpraid dir parameter in the affected PHP files until a patch is available.

Correção

Identificadores relacionados

CVE-2006-3116

Produtos afetados

Phpraid

Referências · 19

• http://osvdb.org/26901 · Nota
• http://osvdb.org/26895 · Nota
• http://osvdb.org/26892 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/27465 · Nota
• http://osvdb.org/26894 · Nota
• http://archives.neohapsis.com/archives/fulldisclosure/2006-06/0824.html · Nota
• http://secunia.com/secunia_research/2006-47/advisory · Aviso do Fabricante
• http://osvdb.org/26891 · Nota
• http://osvdb.org/26900 · Nota
• http://osvdb.org/26893 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2006-3116 · Nota de Segurança
• http://securityfocus.com/bid/18719 · Nota
• http://osvdb.org/26897 · Nota
• http://secunia.com/advisories/20200 · Aviso do Fabricante
• http://osvdb.org/26896 · Nota