PT-2005-5268 · Tinymce · Tinymce Compressor Php

Irk4Z · Published 2005-12-31 · Updated 2018-10-19 · CVE-2005-4600

Positive Technologies (AI Summary)

CVSS v2.0

6.4

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions TinyMCE Compressor PHP versions prior to 1.06

Description The issue allows remote attackers to read or include arbitrary files via a trailing null byte (%00) in the theme, language, plugins, or lang parameter. This can be exploited by sending a specially crafted request to the vulnerable API endpoint.

Recommendations For versions prior to 1.06, update to version 1.06 or later to resolve the issue. As a temporary workaround, consider restricting access to the tiny mce gzip.php file to minimize the risk of exploitation. Avoid using the theme, language, plugins, or lang parameter with a trailing null byte (%00) in the affected API endpoint until the issue is resolved.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2005-4600

Affected Products

Tinymce Compressor Php

References · 15

• 🔥 https://exploit-db.com/exploits/4441 · Exploit
• http://securityfocus.com/bid/16083 · Patch
• https://security-tracker.debian.org/tracker/CVE-2005-4600 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2005-4600 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2005-4600 · Vendor Advisory
• http://secunia.com/advisories/18262 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2005-4600 · Security Note
• http://hardened-php.net/advisory_262005.111.html · Vendor Advisory
• http://tinymce.moxiecode.com/punbb/viewtopic.php?id=2233 · Patch
• http://osvdb.org/22116 · Note
• http://tinymce.moxiecode.com/punbb/viewtopic.php?id=2244 · Note
• http://securityreason.com/securityalert/306 · Note
• http://securityfocus.com/archive/1/420543/100/0/threaded · Note
• http://securitytracker.com/id?1015424 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/36736 · Note