PT-2006-4079 · Asp · Asp Stats Generator

Hamid Ebadi · Publicado 2006-06-23 · Atualizado 2017-10-19 · CVE-2006-3184

Positive Technologies (AI Summary)

CVSS v2.0

4.0

Média

Vetor base

AV:N/AC:L/Au:S/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions ASP Stats Generator versions prior to 2.1.2

Description A direct static code injection issue allows remote authenticated attackers to execute arbitrary ASP code. This is achieved via the strAsgSknPageBgColour parameter to the "settings skin.asp" endpoint, with the malicious code being stored in "inc skin file.asp".

Recommendations For versions prior to 2.1.2, update to version 2.1.2 or later to resolve the issue. As a temporary workaround, consider restricting access to the "settings skin.asp" endpoint and avoid using the strAsgSknPageBgColour parameter until the issue is resolved.

Exploit

Correção

Identificadores relacionados

CVE-2006-3184

Produtos afetados

Asp Stats Generator

Referências · 7

• 🔥 https://exploit-db.com/exploits/1931 · Exploit
• http://secunia.com/advisories/20721 · Aviso do Fabricante
• http://vupen.com/english/advisories/2006/2414 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2006-3184 · Nota de Segurança
• http://hamid.ir/security/aspstats.txt · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/27284 · Nota
• http://blog.asp-stats.com/index.php/2006/06/18/asp-stats-generator-v212 · Nota