PT-2005-4706 · Php · Phpx

Published 2005-12-03 · Updated 2024-02-14 · CVE-2005-3968

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions PHPX versions 3.5.9 and earlier

Description The issue allows remote attackers to execute arbitrary SQL commands, bypass authentication, and upload arbitrary PHP code via the username parameter. This can be exploited by sending malicious input to the vulnerable API endpoint, potentially leading to unauthorized access and code execution.

Recommendations For PHPX versions 3.5.9 and earlier, update to a version later than 3.5.9 to resolve the issue. As a temporary workaround, consider restricting access to the auth.inc.php file and validating user input to prevent SQL injection attacks. Avoid using the username parameter in the affected API endpoint until the issue is resolved.

Exploit

Fix

Related Identifiers

CVE-2005-3968

Affected Products

Phpx

References · 11

• 🔥 http://rgod.altervista.org/phpx_359_xpl.html · Exploit
• 🔥 http://securitytracker.com/id?1015300 · Exploit
• 🔥 https://exploit-db.com/exploits/26697 · Exploit
• 🔥 http://securityfocus.com/bid/15680 · Exploit
• http://phpx.org/news.php?news_id=139 · Patch
• http://secunia.com/advisories/17858 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2005-3968 · Security Note
• http://vupen.com/english/advisories/2005/2696 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/23459 · Note
• http://securityfocus.com/archive/1/418253/100/0/threaded · Note
• http://osvdb.org/21384 · Note