PT-2006-4805 · X Scripts · X-Scripts X-Protection

Publicado 2006-08-01 · Atualizado 2017-07-20 · CVE-2006-3959

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions X-Scripts X-Protection version 1.10

Description The issue allows remote attackers to execute arbitrary SQL commands. This is achieved through a SQL injection vulnerability in the protect.php file, specifically when magic quotes gpc is disabled. The vulnerability can be exploited via the username and password parameters.

Recommendations For X-Scripts X-Protection version 1.10, consider disabling the protect.php file or restricting access to it until a patch is available. As a temporary workaround, enable magic quotes gpc to prevent SQL injection attacks. Avoid using the username and password parameters in the protect.php file until the issue is resolved.

Exploit

Correção

Identificadores relacionados

CVE-2006-3959

Produtos afetados

X-Scripts X-Protection

Referências · 8

• 🔥 http://downloads.securityfocus.com/vulnerabilities/exploits/x-protection_poc.txt · Exploit
• 🔥 https://exploit-db.com/exploits/28303 · Exploit
• 🔥 http://securityfocus.com/bid/19235 · Exploit
• https://exchange.xforce.ibmcloud.com/vulnerabilities/28088 · Nota
• http://osvdb.org/27635 · Nota
• http://vupen.com/english/advisories/2006/3060 · Nota
• http://secunia.com/advisories/21282 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2006-3959 · Nota de Segurança