PT-2006-1248 · Myphp · Myphpim

Aliaksandr Hartsuyeu · Published 2006-01-11 · Updated 2018-10-19 · CVE-2006-0169

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions MyPhPim version 01.05

Description The issue allows remote attackers to execute arbitrary PHP code by uploading files without restrictions. This is achieved via the pdbfile variable, and then directly accessing those files from the uploads directory.

Recommendations For MyPhPim version 01.05, restrict uploaded files to prevent remote attackers from executing arbitrary PHP code. As a temporary workaround, consider disabling file uploads until a patch is available. Restrict access to the uploads directory to minimize the risk of exploitation. Avoid using the pdbfile variable in the affected addresses.php3 file until the issue is resolved.

Exploit

Fix

Related Identifiers

CVE-2006-0169

Affected Products

Myphpim

References · 7

• 🔥 http://evuln.com/vulns/23/summary.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2006-0169 · Security Note
• http://secunia.com/advisories/18399 · Vendor Advisory
• http://securityfocus.com/bid/16208 · Note
• http://securityfocus.com/archive/1/421626/100/0/threaded · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/24070 · Note
• http://vupen.com/english/advisories/2006/0147 · Note