PT-2006-5990 · Gcards · Gcards

Str0Ke · Publicado 2006-10-12 · Atualizado 2024-08-07 · CVE-2006-5255

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions gCards version 1.13

Description A remote file inclusion issue exists, allowing remote attackers to execute arbitrary PHP code. This is achieved via a URL in the languagefile parameter in the addnews.php file. However, it has been observed that languageFile is defined before use, which may affect the vulnerability's impact.

Recommendations For gCards version 1.13, consider restricting access to the addnews.php file or the languagefile parameter to minimize the risk of exploitation. As a temporary workaround, avoid using the languagefile parameter in the affected API endpoint until the issue is resolved.

Exploit

Correção

Identificadores relacionados

CVE-2006-5255

Produtos afetados

Gcards

Referências · 5

• 🔥 http://securityfocus.com/bid/20461 · Exploit
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-5255 · Nota
• http://marc.info/?l=bugtraq&m=116059865515095&w=2 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2006-5255 · Nota de Segurança
• http://securityfocus.com/archive/1/448293/100/0/threaded · Nota