PT-2006-5252 · Web3News · Web3News

Shikaa · Publicado 2006-08-30 · Atualizado 2017-10-19 · CVE-2006-4452

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Web3news versions 0.95 and earlier

Description The issue allows remote attackers to execute arbitrary PHP code when register globals is enabled. This is achieved via a URL in the PHPSECURITYADMIN PATH parameter.

Recommendations For Web3news versions 0.95 and earlier, disable the register globals setting to prevent exploitation. As a temporary workaround, consider restricting access to the security/include/ class.security.php file until a patch is available. Avoid using the PHPSECURITYADMIN PATH parameter in affected URLs until the issue is resolved.

Exploit

Correção

Identificadores relacionados

CVE-2006-4452

Produtos afetados

Web3News

Referências · 7

• 🔥 https://exploit-db.com/exploits/2269 · Exploit
• 🔥 http://securityfocus.com/bid/19744 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2006-4452 · Nota de Segurança
• http://vupen.com/english/advisories/2006/3407 · Nota
• http://secunia.com/advisories/21640 · Aviso do Fabricante
• https://exchange.xforce.ibmcloud.com/vulnerabilities/28618 · Nota
• http://osvdb.org/28248 · Nota