PT-2006-4991 · Chaussette · Chaussette

Drago84 · Publicado 2006-08-16 · Atualizado 2017-10-19 · CVE-2006-4159

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Chaussette version 080706 and earlier

Description The issue allows remote attackers to execute arbitrary PHP code via a URL in the BASE parameter to various scripts in the Classes/ directory, including Evenement.php, Event.php, Event for month.php, Event for week.php, My Log.php, My Smarty.php, and possibly Event for month per day.php.

Recommendations For Chaussette version 080706 and earlier, consider restricting access to the vulnerable scripts in the Classes/ directory until a patch is available. As a temporary workaround, avoid using the BASE parameter in the affected scripts.

Exploit

Correção

Code Injection

Enumeração de Fraquezas

CWE-94

Identificadores relacionados

CVE-2006-4159

Produtos afetados

Chaussette

Referências · 12

• 🔥 http://securityfocus.com/bid/19480 · Exploit
• 🔥 http://secunia.com/advisories/21489 · Exploit
• 🔥 https://exploit-db.com/exploits/2169 · Exploit
• http://osvdb.org/27901 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/28327 · Nota
• http://osvdb.org/27897 · Nota
• http://osvdb.org/27898 · Nota
• http://osvdb.org/27899 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2006-4159 · Nota de Segurança
• http://osvdb.org/27900 · Nota
• http://vupen.com/english/advisories/2006/3269 · Aviso do Fabricante
• http://osvdb.org/27902 · Nota