PT-2006-6825 · Fixit · Fixit Idms Pro Image Gallery

Publicado 2006-12-01 · Atualizado 2018-10-17 · CVE-2006-6195

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Fixit iDMS Pro Image Gallery (affected versions not specified)

Description The issue concerns multiple SQL injection vulnerabilities. These vulnerabilities allow remote attackers to execute arbitrary SQL commands. The exploitation can occur through specific parameters in certain files, including the show id or parentid parameter to "filelist.asp", or the fid parameter to "showfile.asp".

Recommendations For Fixit iDMS Pro Image Gallery, consider restricting access to the "filelist.asp" and "showfile.asp" files until a patch is available. As a temporary workaround, avoid using the show id, parentid, and fid parameters in the affected API endpoints until the issue is resolved. Restrict input to these parameters to minimize the risk of SQL injection attacks.

Exploit

Correção

Identificadores relacionados

CVE-2006-6195

Produtos afetados

Fixit Idms Pro Image Gallery

Referências · 8

• 🔥 https://exploit-db.com/exploits/29179 · Exploit
• 🔥 https://exploit-db.com/exploits/29178 · Exploit
• http://aria-security.com/forum/showthread.php?t=39 · Nota
• http://securitytracker.com/id?1017281 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/30513 · Nota
• http://securityfocus.com/bid/21282 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2006-6195 · Nota de Segurança
• http://securityfocus.com/archive/1/452567/100/0/threaded · Nota