PT-2006-7369 · Php · Php Live!

Doz · Publicado 2006-12-27 · Atualizado 2018-10-17 · CVE-2006-6769

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions: PHP Live! versions 3.2.2 and earlier

Description: The issue allows remote attackers to inject arbitrary web script or HTML, potentially leading to security breaches. This is achieved through several parameters in different PHP files, including the search string parameter in "setup/transcripts.php", the l parameter in "index.php", the login field in "phplive/index.php", and the deptid and x parameters in "phplive/message box.php".

Recommendations: For PHP Live! versions 3.2.2 and earlier, consider disabling the vulnerable parameters search string, l, login, deptid, and x in their respective files until a patch is available. Restrict access to the affected PHP files to minimize the risk of exploitation. Avoid using the parameters search string, l, login, deptid, and x in the affected API endpoints until the issue is resolved.

Exploit

Correção

Identificadores relacionados

CVE-2006-6769

Produtos afetados

Php Live!

Referências · 7

• 🔥 http://hackerscenter.com/archive/view.asp?id=26833 · Exploit
• 🔥 http://securityfocus.com/bid/21737 · Exploit
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-6769 · Nota
• http://securityfocus.com/archive/1/455269/100/0/threaded · Nota
• http://secunia.com/advisories/23488 · Aviso do Fabricante
• http://securityreason.com/securityalert/2068 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2006-6769 · Nota de Segurança