PT-2007-1326 · Shoutpro · Shoutpro

Steven M. Christey · Publicado 2007-02-24 · Atualizado 2018-10-16 · CVE-2006-7047

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Shoutpro version 1.0

Description The issue allows remote attackers to bypass IP ban restrictions. This is achieved by providing a URL in the path parameter that points to an alternate bannedips.php file. It was initially reported as a potential remote file inclusion issue, but further analysis indicates it cannot be used for code execution.

Recommendations For Shoutpro version 1.0, consider restricting access to the include.php file to prevent bypassing IP ban restrictions until a fix is available. As a temporary workaround, restrict the use of the path parameter to minimize the risk of exploitation.

Correção

Enumeração de Fraquezas

CWE-264

Identificadores relacionados

CVE-2006-7047

Produtos afetados

Shoutpro

Referências · 5

• http://securityfocus.com/archive/1/436997/30/4410/threaded · Nota
• http://securityfocus.com/archive/1/436975/30/4440/threaded · Nota
• http://securityreason.com/securityalert/2303 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/27111 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2006-7047 · Nota de Segurança