PT-2006-4868 · Flant+1 · Minibb+1

Publicado

2006-08-08

·

Atualizado

2018-10-17

·

CVE-2006-4023

CVSS v2.0

5.0

Média

VetorAV:N/AC:L/Au:N/C:P/I:N/A:N
Name of the Vulnerable Software and Affected Versions PHP versions 5.1.4 and earlier
Description The ip2long function in PHP may incorrectly validate an arbitrary string and return a valid network IP address. This allows remote attackers to obtain network information and facilitate other attacks, such as SQL injection in the X-FORWARDED-FOR Header. The issue is demonstrated in MiniBB 2.0, where it can be exploited using the index.php file.
Recommendations For PHP versions 5.1.4 and earlier, consider updating to a newer version to mitigate the risk. As a temporary workaround, restrict the use of the ip2long function in security-relevant contexts to minimize the risk of exploitation. Avoid using the ip2long function with untrusted input, such as the X-FORWARDED-FOR Header, until the issue is resolved.

Exploit

Correção

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Identificadores relacionados

CVE-2006-4023

Produtos afetados

Minibb
Php