PT-2006-6519 · Speedywiki · Speedywiki

Benjamin Mossé + 1 · Publicado 2006-11-10 · Atualizado 2024-02-14 · CVE-2006-5845

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Média

Vetor base

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Speedywiki version 2.0

Description The issue allows remote authenticated users to upload and execute arbitrary PHP code. This is achieved by setting the upload parameter to 1 in the index.php file.

Recommendations For Speedywiki version 2.0, consider restricting access to the index.php file to prevent unauthorized uploads until a patch is available. As a temporary workaround, disable the file upload functionality in index.php to minimize the risk of exploitation.

Correção

Unrestricted File Upload

Enumeração de Fraquezas

CWE-434

Identificadores relacionados

CVE-2006-5845

Produtos afetados

Speedywiki

Referências · 7

• http://securitytracker.com/id?1017201 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2006-5845 · Nota de Segurança
• http://secunia.com/advisories/22788 · Nota
• http://vupen.com/english/advisories/2006/4421 · Nota
• http://marc.info/?l=bugtraq&m=116302805802656&w=2 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/30131 · Nota
• http://s-a-p.ca/index.php?page=OurAdvisories&id=9 · Nota