PT-2005-4315 · Mysource · Mysource

Published 2005-11-06 · Updated 2017-07-11 · CVE-2005-3519

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions MySource version 2.14.0

Description The issue allows remote attackers to execute arbitrary PHP code and include arbitrary local files. This is achieved through multiple PHP file inclusion vulnerabilities via the INCLUDE PATH and SQUIZLIB PATH parameters in new upgrade functions.php, the INCLUDE PATH parameter in init mysource.php, and the PEAR PATH parameter in various PHP files, including Socket.php, Request.php, Mail.php, Date.php, Span.php, mimeDecode.php, and mime.php.

Recommendations For MySource version 2.14.0, consider restricting access to the vulnerable parameters INCLUDE PATH, SQUIZLIB PATH, and PEAR PATH until a patch is available. As a temporary workaround, avoid using these parameters in the affected PHP files.

Exploit

Fix

Related Identifiers

CVE-2005-3519

Affected Products

Mysource

References · 26

• 🔥 https://exploit-db.com/exploits/26364 · Exploit
• 🔥 http://securitytracker.com/id?1015075 · Exploit
• 🔥 http://secunia.com/advisories/16946 · Exploit
• 🔥 https://exploit-db.com/exploits/26371 · Exploit
• 🔥 https://exploit-db.com/exploits/26370 · Exploit
• 🔥 https://exploit-db.com/exploits/26365 · Exploit
• 🔥 https://exploit-db.com/exploits/26362 · Exploit
• 🔥 https://exploit-db.com/exploits/26363 · Exploit
• 🔥 https://exploit-db.com/exploits/26373 · Exploit
• 🔥 https://exploit-db.com/exploits/26369 · Exploit
• 🔥 https://exploit-db.com/exploits/26372 · Exploit
• 🔥 http://securityfocus.com/bid/15133/discuss · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2005-3519 · Security Note
• http://osvdb.org/20042 · Note
• http://osvdb.org/20039 · Note