PT-2005-5475 · Apache+1 · Apache Http Server+1

Published 2005-12-31 · Updated 2008-09-05 · CVE-2005-4814

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Segue CMS versions prior to 1.3.6

Description The issue allows remote attackers to upload and execute arbitrary PHP code. This is possible when the Apache HTTP Server handles .phtml files with the PHP interpreter, and .phtml files are placed in the userfiles/ directory.

Recommendations For versions prior to 1.3.6, update to version 1.3.6 or later to resolve the issue. As a temporary workaround, consider restricting access to the userfiles/ directory to minimize the risk of exploitation.

Fix

Related Identifiers

CVE-2005-4814

Affected Products

Apache Http Server

Segue Cms

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2005-4814 · Security Note
• http://osvdb.org/29902 · Note
• http://sourceforge.net/project/shownotes.php?release_id=456920&group_id=82171 · Note