PT-2005-4343 · Php · Phpkit

Published 2005-11-16 · Updated 2017-07-11 · CVE-2005-3554

Positive Technologies (AI Summary)

CVSS v2.0

5.1

Medium

Base vector

AV:N/AC:H/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions PHPKIT versions 1.6.1 R2 and earlier

Description The issue concerns multiple eval injection vulnerabilities in the help function of PHPKIT. When register globals is enabled, remote attackers can execute arbitrary code on the server via unknown attack vectors involving uninitialized variables.

Recommendations For PHPKIT versions 1.6.1 R2 and earlier, disable the register globals setting to prevent exploitation of this issue. Additionally, consider disabling the help function until a patch is available.

Exploit

Fix

RCE

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2005-3554

Affected Products

Phpkit

References · 10

• 🔥 http://hardened-php.net/advisory_212005.80.html · Exploit
• http://secunia.com/advisories/17479 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2005-3554 · Security Note
• http://vupen.com/english/advisories/2005/2344 · Vendor Advisory
• http://osvdb.org/20563 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-3554 · Note
• http://securitytracker.com/id?1015167 · Note
• http://securityfocus.com/bid/15354 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/23015 · Note
• http://cert.uni-stuttgart.de/archive/bugtraq/2005/11/msg00110.html · Note