PT-2005-1915 · Double Choco Latte · Double Choco Latte

Published 2005-03-24 · Updated 2017-07-11 · CVE-2005-0887

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Double Choco Latte versions prior to 0.9.4.3

Description The issue allows remote attackers to execute arbitrary PHP code via the menuAction variable in files such as functions.inc.php or main.php. This is due to code being injected into an eval statement, which can lead to the execution of malicious code.

Recommendations For versions prior to 0.9.4.3, update to version 0.9.4.3 or later to resolve the issue. As a temporary workaround, consider restricting access to the menuAction variable in the affected files to minimize the risk of exploitation.

Exploit

Fix

Related Identifiers

CVE-2005-0887

Affected Products

Double Choco Latte

References · 6

• 🔥 https://exploit-db.com/exploits/25271 · Exploit
• http://securitytracker.com/id?1013559 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2005-0887 · Security Note
• http://secunia.com/advisories/14688 · Vendor Advisory
• http://sourceforge.net/project/shownotes.php?release_id=315144 · Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/19806 · Note