PT-2007-1298 · Phpcms · Phpcms

Bugreporter · Publicado 2007-02-15 · Atualizado 2017-07-29 · CVE-2006-7019

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions phpwcms versions 1.2.5-DEV and earlier phpwcms versions 1.1 before RC4

Description The issue allows remote attackers to execute arbitrary code via crafted arguments to the text evento and email eventonome evento parameters to "phpwcms code snippets/mail file form.php" and "sample ext php/mail file form.php", which is processed by the render PHPcode function.

Recommendations For phpwcms versions 1.2.5-DEV and earlier, consider disabling the render PHPcode function until a patch is available. For phpwcms versions 1.1 before RC4, avoid using the text evento and email eventonome evento parameters in the affected API endpoints until the issue is resolved.

Correção

Identificadores relacionados

CVE-2006-7019

Produtos afetados

Phpcms

Referências · 6

• http://vupen.com/english/advisories/2006/1556 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2006-7019 · Nota de Segurança
• https://exchange.xforce.ibmcloud.com/vulnerabilities/26126 · Nota
• http://secunia.com/advisories/19866 · Aviso do Fabricante
• http://phpwcms.de/forum/viewtopic.php?t=10958 · Correção
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-7019 · Nota