PT-2006-6987 · Sfm · Simple File Manager

Flame · Publicado 2006-12-07 · Atualizado 2017-10-19 · CVE-2006-6376

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Simple File Manager (SFM) version 0.24a

Description The issue allows remote attackers to perform directory traversal attacks using ".." sequences. This can be used to read arbitrary files via the filename parameter in a "download" action, delete arbitrary files via the delete parameter, and modify arbitrary files via the edit parameter. These actions can potentially be leveraged to execute arbitrary code.

Recommendations For Simple File Manager (SFM) version 0.24a, consider restricting access to the fm.php file until a patch is available. As a temporary workaround, avoid using the filename, delete, and edit parameters in the affected actions to minimize the risk of exploitation.

Exploit

Correção

Identificadores relacionados

CVE-2006-6376

Produtos afetados

Simple File Manager

Referências · 3

• 🔥 https://exploit-db.com/exploits/2883 · Exploit
• https://exchange.xforce.ibmcloud.com/vulnerabilities/30687 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2006-6376 · Nota de Segurança