PT-2006-5248 · Interact · Interact

Kacper · Publicado 2006-08-30 · Atualizado 2018-10-17 · CVE-2006-4448

Positive Technologies (AI Summary)

CVSS v2.0

5.1

Média

Vetor base

AV:N/AC:H/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions interact version 2.2

Description The issue allows remote attackers to execute arbitrary PHP code via specific parameters in certain files when register globals is enabled. This can be achieved by manipulating the CONFIG[BASE PATH] parameter in files such as admin/autoprompter.php and includes/common.inc.php, and the CONFIG[LANGUAGE CPATH] parameter in admin/autoprompter.php.

Recommendations For interact version 2.2, consider disabling the register globals setting to prevent exploitation. Additionally, restrict access to the admin/autoprompter.php and includes/common.inc.php files to minimize the risk of arbitrary PHP code execution. Avoid using the CONFIG[BASE PATH] and CONFIG[LANGUAGE CPATH] parameters in the affected files until the issue is resolved.

Exploit

Correção

Identificadores relacionados

CVE-2006-4448

Produtos afetados

Interact

Referências · 6

• 🔥 http://securityfocus.com/bid/19739 · Exploit
• 🔥 https://exploit-db.com/exploits/2218 · Exploit
• http://securityreason.com/securityalert/1471 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2006-4448 · Nota de Segurança
• https://exchange.xforce.ibmcloud.com/vulnerabilities/28485 · Nota
• http://securityfocus.com/archive/1/444526/100/0/threaded · Nota