PT-2006-7115 · Dada · Dadaimc

Publicado 2006-12-14 · Atualizado 2017-07-29 · CVE-2006-6511

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions dadaIMC version .99.3

Description The issue arises from an insufficiently restrictive FilesMatch directive in the installed .htaccess file. This allows remote attackers to execute arbitrary PHP code by uploading files with specific names, including those containing feature, editor, newswire, otherpress, admin, pbook, media, or mod. These file names are processed as PHP file types, leading to potential code execution.

Recommendations For dadaIMC version .99.3, consider updating the .htaccess file to include more restrictive FilesMatch directives to prevent the execution of arbitrary PHP code from uploaded files. As a temporary workaround, restrict access to file uploads or limit the types of files that can be uploaded to prevent potential exploitation.

Correção

Identificadores relacionados

CVE-2006-6511

Produtos afetados

Dadaimc

Referências · 5

• http://vupen.com/english/advisories/2006/4977 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/30862 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2006-6511 · Nota de Segurança
• http://bugs.dadaimc.org/view.php?id=191 · Nota
• http://secunia.com/advisories/23305 · Aviso do Fabricante