PT-2005-3797 · Azdg · Azdgdatinglite

Retrogod · Published 2005-09-16 · Updated 2017-07-11 · CVE-2005-2951

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions AzDGDatingLite versions 2.1.3 and possibly earlier

Description The issue allows remote attackers to execute arbitrary PHP commands. This is achieved by using ".." sequences and "%00" (trailing null byte) characters in the l parameter, which is used in an include once statement.

Recommendations For versions 2.1.3 and possibly earlier, consider restricting access to the security.inc.php file until a patch is available. As a temporary workaround, avoid using the l parameter in the include once statement to minimize the risk of exploitation.

Exploit

Fix

Related Identifiers

CVE-2005-2951

Affected Products

Azdgdatinglite

References · 8

• 🔥 http://rgod.altervista.org/azdg.html · Exploit
• 🔥 http://securityfocus.com/bid/14819 · Exploit
• 🔥 https://exploit-db.com/exploits/1214 · Exploit
• http://secunia.com/advisories/16814 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2005-2951 · Security Note
• http://marc.info/?l=bugtraq&m=112662698511403&w=2 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/22258 · Note
• http://securityreason.com/securityalert/5 · Note