PT-2006-5378 · Alstrasoft+1 · Alstrasoft Template Seller Pro+1

Noge A.K.A Da_Jackass · Publicado 2006-09-06 · Atualizado 2018-10-17 · CVE-2006-4591

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions AlstraSoft Template Seller versions prior to the fixed version AltraSoft Template Seller Pro version 3.25

Description The issue allows remote attackers to execute arbitrary PHP code. This can be achieved by providing a URL in the config[template path] parameter to specific API endpoints, such as "/payment/payment result.php" or "/payment/spuser result.php".

Recommendations For AlstraSoft Template Seller versions prior to the fixed version, update to the fixed version to resolve the issue. For AltraSoft Template Seller Pro version 3.25, update to a version that contains a fix for this issue. As a temporary workaround, consider restricting access to the payment result.php and spuser result.php files until a patch is available. Avoid using the config[template path] parameter in the affected API endpoints until the issue is resolved.

Exploit

Correção

Identificadores relacionados

CVE-2006-4591

Produtos afetados

Alstrasoft Template Seller Pro

Php

Referências · 5

• 🔥 http://securityfocus.com/bid/19769 · Exploit
• 🔥 https://exploit-db.com/exploits/28444 · Exploit
• http://securityreason.com/securityalert/1509 · Nota
• http://securityfocus.com/archive/1/445156/100/0/threaded · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2006-4591 · Nota de Segurança