PT-2006-6465 · E107 · E107

Kacper · Publicado 2006-11-07 · Atualizado 2017-10-19 · CVE-2006-5786

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions: e107 versions 0.7.5 and earlier

Description: A directory traversal issue exists, allowing remote attackers to read and execute PHP code in arbitrary files. This is achieved by using ".." sequences in the e107language e107cookie cookie to gsitemap.php.

Recommendations: For versions 0.7.5 and earlier, as a temporary workaround, consider restricting access to the gsitemap.php file until a patch is available. Avoid using the e107language e107cookie cookie with unvalidated input in the affected API endpoint until the issue is resolved.

Exploit

Correção

Identificadores relacionados

CVE-2006-5786

Produtos afetados

E107

Referências · 5

• 🔥 https://exploit-db.com/exploits/2711 · Exploit
• 🔥 http://securityfocus.com/bid/20913 · Exploit
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-5786 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2006-5786 · Nota de Segurança
• https://exchange.xforce.ibmcloud.com/vulnerabilities/30030 · Nota