PT-2005-3450 · E107 · E107 Eping Plugin

Published 2005-08-16 · Updated 2024-02-14 · CVE-2005-2559

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions e107 ePing plugin versions 1.02 and earlier

Description The issue allows remote attackers to execute arbitrary code or overwrite files. This can be achieved through shell metacharacters in the eping count parameter or restricted shell metacharacters such as ">" and "&" in the eping host parameter. The validation function does not properly handle these parameters.

Recommendations For e107 ePing plugin versions 1.02 and earlier, consider disabling the doping.php file until a patch is available. Restrict access to the eping count and eping host parameters to minimize the risk of exploitation. Avoid using restricted shell metacharacters in the eping host parameter.

Fix

Related Identifiers

CVE-2005-2559

Affected Products

E107 Eping Plugin

References · 3

• http://e107plugins.co.uk/news.php · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2005-2559 · Security Note
• http://marc.info/?l=bugtraq&m=112328161319148&w=2 · Note