PT-2006-5666 · A.L-Pifou · A.L-Pifou

Cdg393 · Publicado 2006-09-21 · Atualizado 2017-07-20 · CVE-2006-4914

Positive Technologies (AI Summary)

CVSS v2.0

2.6

Baixa

Vetor base

AV:N/AC:H/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions A.l-Pifou version 1.8p2

Description The issue allows remote attackers to read arbitrary files via ".." sequences in the ze langue 02 cookie. This can be achieved by using the choix lng parameter to choix langue.php to indirectly set the cookie, then accessing livre dor.php to trigger the inclusion from inc/change lang ck.php. There is a possible relationship with livre livre.php, as reported by some third-party sources.

Recommendations For A.l-Pifou version 1.8p2, consider restricting access to the choix langue.php and livre dor.php scripts until a patch is available. As a temporary workaround, avoid using the choix lng parameter in the choix langue.php script to minimize the risk of exploitation.

Exploit

Correção

Identificadores relacionados

CVE-2006-4914

Produtos afetados

A.L-Pifou

Referências · 7

• 🔥 http://seclists.org/fulldisclosure/2006/Sep/0341.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2006-4914 · Nota de Segurança
• http://securityfocus.com/bid/20120 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/29050 · Nota
• http://vupen.com/english/advisories/2006/3707 · Nota
• http://osvdb.org/29014 · Nota
• http://secunia.com/advisories/22038 · Aviso do Fabricante