PT-2007-1331 · Dotwidget · Dotwidget For Articles

Sweet-Devil · Publicado 2007-02-24 · Atualizado 2017-07-29 · CVE-2006-7052

Positive Technologies (AI Summary)

CVSS v2.0

10

Alta

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions DotWidget For Articles (dotwidgeta) version 0.2

Description The issue allows remote attackers to execute arbitrary code via specific parameters in various PHP files. This is achieved by providing a URL in the file path parameter to files such as "index.php", "showcatpicks.php", and "showarticle.php". Additionally, attackers can exploit the admin header file and admin footer file parameters in files like "admin/authors.php", "admin/index.php", "admin/categories.php", "admin/editconfig.php", and "admin/articles.php".

Recommendations For DotWidget For Articles (dotwidgeta) version 0.2, consider disabling the file path, admin header file, and admin footer file parameters in the affected PHP files until a patch is available. Restrict access to the vulnerable PHP files to minimize the risk of exploitation. Avoid using the file path, admin header file, and admin footer file parameters in the affected API endpoints until the issue is resolved.

Exploit

Correção

Identificadores relacionados

CVE-2006-7052

Produtos afetados

Dotwidget For Articles

Referências · 12

• 🔥 https://exploit-db.com/exploits/28040 · Exploit
• 🔥 https://exploit-db.com/exploits/28046 · Exploit
• 🔥 https://exploit-db.com/exploits/28039 · Exploit
• 🔥 http://securityfocus.com/archive/1/437483 · Exploit
• 🔥 https://exploit-db.com/exploits/28045 · Exploit
• 🔥 http://securityfocus.com/bid/18479 · Exploit
• 🔥 https://exploit-db.com/exploits/28042 · Exploit
• 🔥 https://exploit-db.com/exploits/28043 · Exploit
• 🔥 https://exploit-db.com/exploits/28041 · Exploit
• http://securityreason.com/securityalert/2308 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2006-7052 · Nota de Segurança
• https://exchange.xforce.ibmcloud.com/vulnerabilities/27327 · Nota