PT-2006-6749 · Lifetype · Lifetype

Jesper Jurcenoks · Publicado 2006-12-06 · Atualizado 2018-10-17 · CVE-2006-6112

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions LifeType versions 1.0.x through 1.1.x

Description The issue is related to insufficient access control for PHP scripts under specific directories, allowing remote attackers to obtain the installation path. This can be achieved by making a direct request to certain scripts, such as bayesianfilter.class.php and bootstrap.php, which may leak the path in an error message.

Recommendations For LifeType versions 1.0.x through 1.1.x, consider restricting direct access to the PHP scripts under the class/ and plugins/ directories to prevent remote attackers from obtaining the installation path. As a temporary workaround, restrict access to the bayesianfilter.class.php and bootstrap.php scripts until a proper fix is applied.

Exploit

Correção

Identificadores relacionados

CVE-2006-6112

Produtos afetados

Lifetype

Referências · 8

• 🔥 http://netvigilance.com/advisory0008 · Exploit
• http://securityreason.com/securityalert/1980 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2006-6112 · Nota de Segurança
• http://lifetype.net/blog.php/lifetype-development-journal/2006/11/30/full_path_disclosure_vulnerability_in_lifetype_1.0.x_and_1.1.x · Aviso do Fabricante
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-6112 · Nota
• http://securityfocus.com/archive/1/453135/100/0/threaded · Nota
• http://osvdb.org/30685 · Aviso do Fabricante
• https://exchange.xforce.ibmcloud.com/vulnerabilities/30635 · Nota