PT-2006-7152 · Rad · Radupload

Arham · Publicado 2006-12-14 · Atualizado 2024-08-07 · CVE-2006-6549

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Rad Upload version 3.02

Description A remote file inclusion issue exists due to the handling of the save path parameter in the upload.php file. This could potentially allow remote attackers to execute arbitrary PHP code by providing a URL in the save path parameter. However, it's noted that the save path is initially defined as an empty string before use.

Recommendations For Rad Upload version 3.02, ensure that the save path parameter is properly validated and sanitized to prevent remote file inclusion attacks. Consider temporarily restricting access to the upload.php file until a proper fix can be applied. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Identificadores relacionados

CVE-2006-6549

Produtos afetados

Radupload

Referências · 4

• https://nvd.nist.gov/vuln/detail/CVE-2006-6549 · Nota de Segurança
• http://securityfocus.com/archive/1/454175/100/0/threaded · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/30864 · Nota
• http://securityreason.com/securityalert/2034 · Nota