PT-2006-1545 · Pmwiki · Pmwiki

Ascii + 1 · Published 2006-01-31 · Updated 2017-07-20 · CVE-2006-0479

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions PmWiki version 2.1 beta 20

Description The issue allows remote attackers to bypass protection mechanisms by setting both a GPC variable and a GLOBALS[] variable with the same name. This causes PmWiki to unset the GLOBALS[] variable but not the GPC variable, resulting in vulnerabilities such as remote file inclusion and cross-site scripting (XSS).

Recommendations For PmWiki version 2.1 beta 20, consider disabling the register globals setting to prevent exploitation. Additionally, restrict access to the pmwiki.php file to minimize the risk of remote file inclusion and cross-site scripting attacks.

Exploit

Fix

Related Identifiers

CVE-2006-0479

Affected Products

Pmwiki

References · 12

• 🔥 https://exploit-db.com/exploits/27147 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2006-0479 · Security Note
• http://ush.it/2006/01/24/pmwiki-multiple-vulnerabilities · Vendor Advisory
• http://secunia.com/advisories/18634 · Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/24367 · Note
• http://securityfocus.com/bid/16421 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/24368 · Note
• http://vupen.com/english/advisories/2006/0375 · Note
• http://securitytracker.com/id?1015550 · Note
• http://archives.neohapsis.com/archives/fulldisclosure/2006-01/0931.html · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/24366 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-0479 · Note