PT-2006-6151 · Phppowercards · Phppowercards

Nuffsaid · Publicado 2006-10-20 · Atualizado 2017-10-19 · CVE-2006-5432

Positive Technologies (AI Summary)

CVSS v2.0

2.6

Baixa

Vetor base

AV:N/AC:H/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions phpPowerCards version 2.10

Description The issue allows remote attackers to create or overwrite arbitrary files via several parameters when register globals is enabled. The vulnerable parameters include email[to], email[from], name[to], name[from], picture, comment, and sessionID. This can be exploited to create a new .php file that permits remote file inclusion.

Recommendations For phpPowerCards version 2.10, disable the register globals setting to prevent exploitation. Additionally, restrict access to the db/txt.inc.php file and consider validating and sanitizing user input for the email[to], email[from], name[to], name[from], picture, comment, and sessionID parameters to minimize the risk of arbitrary file creation or overwrite.

Exploit

Correção

Identificadores relacionados

CVE-2006-5432

Produtos afetados

Phppowercards

Referências · 7

• 🔥 http://securityfocus.com/bid/20620 · Exploit
• 🔥 https://exploit-db.com/exploits/2590 · Exploit
• http://vupen.com/english/advisories/2006/4105 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2006-5432 · Nota de Segurança
• https://exchange.xforce.ibmcloud.com/vulnerabilities/29669 · Nota
• http://secunia.com/advisories/22471 · Aviso do Fabricante
• http://osvdb.org/29840 · Nota