PT-2006-5613 · Lite Mambo · Limbo Cms

Rgod · Publicado 2006-09-19 · Atualizado 2017-10-19 · CVE-2006-4859

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Limbo (aka Lite Mambo) CMS versions 1.0.4.2L and earlier

Description The issue concerns an unrestricted file upload vulnerability. It allows remote attackers to upload PHP code to the images/contact folder via a filename with a double extension in the contact attach parameter in a contact option in "index.php". This is possible due to an insufficiently restrictive regular expression.

Recommendations For Limbo (aka Lite Mambo) CMS versions 1.0.4.2L and earlier, consider restricting the file types that can be uploaded through the contact option in index.php to prevent the upload of PHP code. As a temporary workaround, restrict access to the images/contact folder to minimize the risk of exploitation.

Exploit

Correção

Identificadores relacionados

CVE-2006-4859

Produtos afetados

Limbo Cms

Referências · 3

• 🔥 https://exploit-db.com/exploits/2370 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2006-4859 · Nota de Segurança
• http://securityfocus.com/bid/20044 · Nota