PT-2006-6222 · Unknown · Der Dirigent

Publicado

2006-10-25

·

Atualizado

2017-07-20

·

CVE-2006-5507

CVSS v2.0

7.5

Alta

VetorAV:N/AC:L/Au:N/C:P/I:P/A:P
Name of the Vulnerable Software and Affected Versions Der Dirigent (DeDi) version 1.0.3
Description The issue allows remote attackers to execute arbitrary PHP code via a URL in the cfg dedi[dedi path] parameter in multiple PHP files, including 'find.php', 'insert line.php', 'fullscreen.php', 'changecase.php', 'insert link.php', 'insert table.php', 'table cellprop.php', 'table prop.php', 'table rowprop.php', 'insert page.php', and possibly 'insert marquee.php' in the 'backend/external/wysiswg/popups/' directory.
Recommendations For Der Dirigent (DeDi) version 1.0.3, consider restricting access to the vulnerable PHP files until a patch is available. As a temporary workaround, avoid using the cfg dedi[dedi path] parameter in the affected files.

Correção

Code Injection

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Enumeração de Fraquezas

CWE-94

Identificadores relacionados

CVE-2006-5507

Produtos afetados

Der Dirigent