PT-2006-4907 · Csaba Godor · Csaba Godor Sapid Blog

Kacper · Publicado 2006-08-10 · Atualizado 2017-10-19 · CVE-2006-4063

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Csaba Godor SAPID Blog versions Beta 2 and earlier

Description The issue allows remote attackers to execute arbitrary PHP code. This can be achieved via a URL in the root path parameter to specific PHP files, such as usr/extensions/get blog infochannel.inc.php, usr/extensions/get blog meta info.inc.php, or usr/extensions/get infochannel.inc.php. Alternatively, it can be done through the GLOBALS[root path] parameter to usr/extensions/get tree.inc.php.

Recommendations For Csaba Godor SAPID Blog versions Beta 2 and earlier, consider disabling access to the usr/extensions directory until a patch is available. Restrict the use of the root path and GLOBALS[root path] parameters in the affected PHP files to minimize the risk of exploitation. Avoid using these parameters in the specified API endpoints until the issue is resolved.

Exploit

Correção

Identificadores relacionados

CVE-2006-4063

Produtos afetados

Csaba Godor Sapid Blog

Referências · 7

• 🔥 https://exploit-db.com/exploits/2130 · Exploit
• 🔥 https://exploit-db.com/exploits/2129 · Exploit
• 🔥 https://exploit-db.com/exploits/2131 · Exploit
• 🔥 https://exploit-db.com/exploits/2128 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2006-4063 · Nota de Segurança
• http://vupen.com/english/advisories/2006/3196 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/28251 · Nota