PT-2005-5261 · Php · Phpdocumentor

Rgod · Published 2005-12-31 · Updated 2018-10-19 · CVE-2005-4593

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions phpDocumentor versions 1.3.0 rc4 and earlier

Description The issue allows remote attackers to execute arbitrary code when register globals is enabled. This can be achieved via a URL in the FORUM[LIB] parameter in "Documentation/tests/bug-559668.php" and the root dir parameter in "docbuilder/file dialog.php".

Recommendations For phpDocumentor versions 1.3.0 rc4 and earlier, consider disabling the register globals setting to prevent exploitation until a patch is available. Restrict access to the affected parameters FORUM[LIB] and root dir in the respective files to minimize the risk of exploitation.

Exploit

Fix

Related Identifiers

CVE-2005-4593

Affected Products

Phpdocumentor

References · 12

• 🔥 https://exploit-db.com/exploits/1395 · Exploit
• 🔥 http://securityfocus.com/bid/16080 · Exploit
• 🔥 http://rgod.altervista.org/phpdocumentor_130rc4_incl_expl.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2005-4593 · Security Note
• http://securityfocus.com/archive/1/420441/100/0/threaded · Note
• http://securitytracker.com/id?1015423 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/23902 · Note
• http://osvdb.org/22115 · Note
• http://secunia.com/advisories/18248 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-4593 · Note
• http://securityreason.com/securityalert/303 · Note
• http://osvdb.org/22114 · Note