PT-2007-1461 · Exhibit Engine · Exhibit Engine

Kacper · Publicado 2007-03-30 · Atualizado 2017-10-11 · CVE-2006-7183

Positive Technologies (AI Summary)

CVSS v2.0

10

Alta

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Exhibit Engine (EE) versions 1.22 and earlier

Description The issue allows remote attackers to execute arbitrary PHP code via a URL in the toroot parameter. This is a result of a PHP remote file inclusion vulnerability in the styles.php file.

Recommendations For Exhibit Engine (EE) versions 1.22 and earlier, consider updating to a version later than 1.22 to resolve the issue. As a temporary workaround, restrict access to the styles.php file to minimize the risk of exploitation. Avoid using the toroot parameter in the affected URL until the issue is resolved.

Exploit

Correção

Identificadores relacionados

CVE-2006-7183

Produtos afetados

Exhibit Engine

Referências · 4

• 🔥 https://exploit-db.com/exploits/2850 · Exploit
• http://securityfocus.com/bid/21313 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2006-7183 · Nota de Segurança
• https://exchange.xforce.ibmcloud.com/vulnerabilities/30516 · Nota