PT-2006-4735 · Gonafish · Gonafish Linkscaffe

Simo64 · Publicado 2006-07-27 · Atualizado 2018-10-17 · CVE-2006-3884

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Gonafish LinksCaffe version 3.0

Description The issue allows remote attackers to execute arbitrary SQL commands via the offset and limit parameters, newdays parameter in a new action, and the link id parameter in a deadlink action. This can also be used for path disclosure by forcing a SQL error or to modify PHP files using OUTFILE.

Recommendations For Gonafish LinksCaffe version 3.0, consider restricting access to the links.php file and validating user input for the offset, limit, newdays, and link id parameters to prevent SQL injection attacks. As a temporary workaround, consider disabling the links.php file until a patch is available.

Exploit

Correção

Identificadores relacionados

CVE-2006-3884

Produtos afetados

Gonafish Linkscaffe

Referências · 11

• 🔥 https://exploit-db.com/exploits/28267 · Exploit
• 🔥 http://securityfocus.com/bid/19149 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2006-3884 · Nota de Segurança
• http://vupen.com/english/advisories/2006/2983 · Nota
• http://securitytracker.com/id?1016584 · Nota
• http://securityfocus.com/archive/1/441087/100/0/threaded · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/27962 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/27961 · Nota
• http://osvdb.org/27518 · Nota
• http://securityreason.com/securityalert/1287 · Nota
• http://secunia.com/advisories/21212 · Nota