PT-2007-1273 · Ozzywork · Ozzywork Gallery

Dj Remix · Publicado 2007-02-12 · Atualizado 2024-01-26 · CVE-2006-6994

Positive Technologies (AI Summary)

CVSS v2.0

6.4

Média

Vetor base

AV:N/AC:L/Au:N/C:N/I:P/A:P

Name of the Vulnerable Software and Affected Versions OzzyWork Gallery versions 2.0 and earlier

Description The issue concerns an unrestricted file upload vulnerability. This allows remote attackers to upload and execute arbitrary ASP files by bypassing client-side security checks.

Recommendations For OzzyWork Gallery versions 2.0 and earlier, consider disabling the file upload functionality in add.asp until a patch is available to prevent the upload and execution of arbitrary ASP files. Restrict access to the add.asp module to minimize the risk of exploitation.

Correção

Unrestricted File Upload

Enumeração de Fraquezas

CWE-434

Identificadores relacionados

CVE-2006-6994

Produtos afetados

Ozzywork Gallery

Referências · 7

• https://exchange.xforce.ibmcloud.com/vulnerabilities/26365 · Nota
• http://vupen.com/english/advisories/2006/1768 · Nota
• http://osvdb.org/25427 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2006-6994 · Nota de Segurança
• http://securityfocus.com/bid/17946 · Nota
• http://secunia.com/advisories/20049 · Nota
• http://marc.info/?l=bugtraq&m=114723238307299&w=2 · Nota