PT-2005-2575 · Fusion · Fusion Sbx

Published 2005-05-16 · Updated 2024-02-14 · CVE-2005-1596

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Fusion SBX versions 1.2 and earlier

Description The issue concerns the improper use of the extract function in index.php, allowing remote attackers to bypass authentication by setting the is logged parameter or execute arbitrary code via the maxname2 parameter.

Recommendations For Fusion SBX versions 1.2 and earlier, consider disabling the vulnerable index.php file or restricting access to it until a proper fix is applied, and avoid using the maxname2 parameter in the affected endpoint. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Related Identifiers

CVE-2005-1596

Affected Products

Fusion Sbx

References · 8

• 🔥 http://securiteam.com/exploits/5OP042KFPU.html · Exploit
• 🔥 http://exploits.co.in/Article1134.html · Exploit
• http://secunia.com/advisories/15257 · Vendor Advisory
• http://osvdb.org/16216 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2005-1596 · Security Note
• http://osvdb.org/16217 · Vendor Advisory
• http://vupen.com/english/advisories/2005/0508 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/20531 · Note