PT-2006-5631 · David Bennett · Php-Post

Hackers Pal · Publicado 2006-09-19 · Atualizado 2018-10-17 · CVE-2006-4877

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions David Bennett PHP-Post (PHPp) versions 1.0 and earlier

Description The issue allows remote attackers to overwrite arbitrary program variables via multiple vectors that use the extract function. This is demonstrated by the table prefix parameter in various PHP files, including "index.php", "profile.php", and "header.php".

Recommendations For David Bennett PHP-Post (PHPp) versions 1.0 and earlier, consider disabling the use of the extract function until a patch is available. Restrict access to the table prefix parameter in the affected PHP files to minimize the risk of exploitation.

Exploit

Correção

Identificadores relacionados

CVE-2006-4877

Produtos afetados

Php-Post

Referências · 10

• 🔥 https://exploit-db.com/exploits/28591 · Exploit
• http://osvdb.org/28965 · Nota
• http://securityreason.com/securityalert/1607 · Nota
• http://osvdb.org/28967 · Nota
• http://osvdb.org/28966 · Nota
• http://vupen.com/english/advisories/2006/3688 · Nota
• http://securityfocus.com/bid/20061 · Nota
• http://secunia.com/advisories/22014 · Nota
• http://securityfocus.com/archive/1/446318/100/0/threaded · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2006-4877 · Nota de Segurança