PT-2006-5543 · Stefan Ernst · Stefan Ernst Newsscript

Publicado 2006-09-13 · Atualizado 2017-07-20 · CVE-2006-4768

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Stefan Ernst Newsscript (aka WM-News) version 0.5 beta

Description The issue allows remote attackers to execute arbitrary PHP code via several parameters in the add go.php file. These parameters include description, issue, title, var, name, keywords, and note, which are stored in an article file.

Recommendations For Stefan Ernst Newsscript (aka WM-News) version 0.5 beta, consider restricting access to the add go.php file and avoid using the vulnerable parameters until a fix is available. As a temporary workaround, consider validating and sanitizing all user input for the description, issue, title, var, name, keywords, and note parameters to prevent code injection. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Identificadores relacionados

CVE-2006-4768

Produtos afetados

Stefan Ernst Newsscript

Referências · 6

• http://secunia.com/advisories/21826 · Aviso do Fabricante
• http://vupen.com/english/advisories/2006/3558 · Nota
• http://osvdb.org/28814 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/28900 · Nota
• http://securityfocus.com/bid/84155 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2006-4768 · Nota de Segurança