PT-2006-1512 · Phpclanwebsite · Phpclanwebsite

Published 2006-01-26 · Updated 2018-10-19 · CVE-2006-0445

Positive Technologies (AI Summary)

CVSS v2.0

4.0

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Phpclanwebsite version 1.23.1

Description The issue allows remote authenticated users to obtain the installation path by specifying an invalid file name to the "uploader page", which can display the full path of "uploader.php". This might be the result of a file inclusion vulnerability.

Recommendations For Phpclanwebsite version 1.23.1, as a temporary workaround, consider restricting access to the uploader page until a patch is available. Avoid using invalid file names in the uploader page to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this issue.

Exploit

Fix

Related Identifiers

CVE-2006-0445

Affected Products

Phpclanwebsite

References · 5

• 🔥 http://h4cky0u.org/advisories/HYSA-2006-002-phpclan.txt · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2006-0445 · Security Note
• http://osvdb.org/22721 · Note
• http://securityfocus.com/bid/16391 · Note
• http://securityfocus.com/archive/1/423145/100/0/threaded · Note