PT-2004-1279 · Phpdig · Phpdig

Frame · Published 2004-02-17 · Updated 2017-10-10 · CVE-2004-0068

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions PhpDig versions 1.6.5 and earlier

Description The issue allows remote attackers to execute arbitrary PHP code by modifying the relative script path parameter to reference a URL on a remote web server that contains the code. This can be done through the config.php file.

Recommendations For PhpDig versions 1.6.5 and earlier, as a temporary workaround, consider restricting access to the config.php file and avoid using the relative script path parameter to reference external URLs until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2004-0068

Affected Products

Phpdig

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2004-0068 · Security Note
• http://phpdig.net/showthread.php?s=58bcc71c822830ec3bbdaae6d56846e0&threadid=393 · Patch
• http://securityfocus.com/bid/9424 · Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/14826 · Note
• http://marc.info/?l=bugtraq&m=107412194008671&w=2 · Note