PT-2006-1685 · Dale Ray · Myquiz

Aliaksandr Hartsuyeu · Published 2006-02-10 · Updated 2018-10-19 · CVE-2006-0628

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Dale Ray MyQuiz version 1.01

Description The issue allows remote attackers to execute arbitrary commands via shell metacharacters in the URL. This is due to the improper handling of shell metacharacters as part of the PATH INFO environment variable.

Recommendations For Dale Ray MyQuiz version 1.01, consider restricting access to the myquiz.pl script until a proper fix is available, and ensure that any user input is properly sanitized to prevent the injection of shell metacharacters. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Related Identifiers

CVE-2006-0628

Affected Products

Myquiz

References · 12

• 🔥 http://evuln.com/vulns/57/summary.html · Exploit
• 🔥 https://exploit-db.com/exploits/1471 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2006-0628 · Security Note
• http://corantodemo.net/coranto/viewnews.cgi?id=EpApAAAVkyirPGThSf&style=dldetails · Patch
• http://osvdb.org/22925 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/24501 · Note
• http://securityfocus.com/archive/1/424266/100/0/threaded · Note
• http://securityfocus.com/archive/1/423921/100/0/threaded · Note
• http://vupen.com/english/advisories/2006/0443 · Note
• http://attrition.org/pipermail/vim/2006-February/000537.html · Note
• http://secunia.com/advisories/18737 · Note
• http://securityreason.com/securityalert/409 · Note