PT-2006-4068 · Content*Builder · Content*Builder

Publicado 2006-06-23 · Atualizado 2018-10-18 · CVE-2006-3173

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Content*Builder version 0.7.5

Description The issue allows remote attackers to execute arbitrary PHP code. This can be achieved via a URL in the path[cb] parameter to libraries/comment/postComment.php and modules/poll/poll.php, the rel parameter to modules/archive/overview.inc.php, and the actualModuleDir parameter to modules/forum/showThread.inc.php.

Recommendations For Content*Builder version 0.7.5, consider disabling the postComment.php and poll.php files in the libraries/comment and modules/poll directories, respectively, until a patch is available. Restrict access to the overview.inc.php file in the modules/archive directory to minimize the risk of exploitation via the rel parameter. Avoid using the actualModuleDir parameter in the showThread.inc.php file until the issue is resolved.

Exploit

Correção

Identificadores relacionados

CVE-2006-3173

Produtos afetados

Content*Builder

Referências · 6

• 🔥 https://exploit-db.com/exploits/30634 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2006-3173 · Nota de Segurança
• http://securityfocus.com/archive/1/481435/100/0/threaded · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/27044 · Nota
• http://securityfocus.com/bid/25914 · Nota
• http://secunia.com/advisories/20557 · Aviso do Fabricante