PT-2006-6897 · Neocrome · Neocrome Land Down Under

Mustafa Can Bjorn Ipekci + 1 · Publicado 2006-12-04 · Atualizado 2018-10-17 · CVE-2006-6268

Positive Technologies (AI Summary)

CVSS v2.0

10

Alta

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Neocrome Land Down Under (LDU) versions 8.x and earlier

Description The issue allows remote authenticated users to execute arbitrary SQL commands. This is achieved via a url-encoded id parameter to the "users.php" endpoint that begins with a valid filename. An example of such an exploit includes using "default.gif" followed by a double-encoded NULL and ' (apostrophe) (%2500%2527).

Recommendations For Neocrome Land Down Under (LDU) versions 8.x and earlier, consider restricting access to the users.php endpoint to minimize the risk of exploitation. Avoid using the id parameter in the affected endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Identificadores relacionados

CVE-2006-6268

Produtos afetados

Neocrome Land Down Under

Referências · 5

• 🔥 http://nukedx.com/?viewdoc=51 · Exploit
• http://securityfocus.com/bid/21227 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2006-6268 · Nota de Segurança
• http://securityfocus.com/archive/1/452259/100/100/threaded · Nota
• http://securityreason.com/securityalert/1954 · Nota