PT-2007-1450 · Php · Php-Stats

Rgod · Publicado 2007-03-20 · Atualizado 2017-10-19 · CVE-2006-7172

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions PHP-Stats versions 0.1.9.1b and earlier

Description The issue allows remote attackers to execute arbitrary code via SQL injection vulnerabilities. This can be achieved by providing a leading dotted-quad IP address string in either the PC-REMOTE-ADDR HTTP header, which is inserted into $ SERVER['HTTP PC REMOTE ADDR'], or the ip parameter.

Recommendations For PHP-Stats versions 0.1.9.1b and earlier, consider disabling the php-stats.recphp.php script until a patch is available to prevent exploitation of the SQL injection vulnerabilities. Restrict access to the ip parameter in the affected script to minimize the risk of exploitation. Avoid using the PC-REMOTE-ADDR HTTP header with untrusted input until the issue is resolved.

Exploit

Correção

Identificadores relacionados

CVE-2006-7172

Produtos afetados

Php-Stats

Referências · 7

• 🔥 https://exploit-db.com/exploits/3497 · Exploit
• 🔥 https://exploit-db.com/exploits/3496 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2006-7172 · Nota de Segurança
• http://vupen.com/english/advisories/2007/1004 · Nota
• http://osvdb.org/34280 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/33031 · Nota
• http://secunia.com/advisories/24553 · Aviso do Fabricante