PT-2006-6111 · Opendock · Opendock Fullcore

Matdhule · Publicado 2006-10-18 · Atualizado 2017-10-19 · CVE-2006-5392

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions OpenDock FullCore versions 4.4 and earlier

Description The issue allows remote attackers to execute arbitrary PHP code via a URL in the doc directory parameter in various PHP scripts, including (1) sw/index sw.php, (2) cart.php, (3) lib cart.php, (4) lib read cart.php, (5) lib sys cart.php, and (6) txt info cart.php in sw/lib cart/, (7) comment.php, (8) find comment.php, and (9) lib comment.php in sw/lib comment/, and (10) sw/lib find/find.php.

Recommendations For OpenDock FullCore versions 4.4 and earlier, consider disabling the doc directory parameter in the affected PHP scripts until a patch is available. Restrict access to the vulnerable PHP scripts to minimize the risk of exploitation. Avoid using the doc directory parameter in the affected API endpoints until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Identificadores relacionados

CVE-2006-5392

Produtos afetados

Opendock Fullcore

Referências · 16

• 🔥 https://exploit-db.com/exploits/2570 · Exploit
• 🔥 http://securityfocus.com/bid/20573 · Exploit
• https://exchange.xforce.ibmcloud.com/vulnerabilities/29578 · Nota
• http://vupen.com/english/advisories/2006/4052 · Nota
• http://osvdb.org/29914 · Nota
• http://osvdb.org/29907 · Nota
• http://osvdb.org/29909 · Nota
• http://secunia.com/advisories/22410 · Nota
• http://osvdb.org/29912 · Nota
• http://osvdb.org/29915 · Nota
• http://osvdb.org/29910 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2006-5392 · Nota de Segurança
• http://osvdb.org/29913 · Nota
• http://osvdb.org/29911 · Nota
• http://osvdb.org/29906 · Nota