PT-2006-1741 · Docmgr · Docmgr

Rgod · Published 2006-02-15 · Updated 2018-10-19 · CVE-2006-0687

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions DocMGR version 0.54.2

Description The issue concerns the process.php file in DocMGR, where the $siteModInfo variable is not initialized when a direct request is made. This allows remote attackers to include arbitrary local files or possibly remote files by modifying the includeModule and siteModInfo variable.

Recommendations For DocMGR version 0.54.2, ensure the $siteModInfo variable is properly initialized in the process.php file to prevent arbitrary file inclusion. As a temporary workaround, consider restricting access to the process.php file or validating user input to minimize the risk of exploitation.

Exploit

Fix

Related Identifiers

CVE-2006-0687

Affected Products

Docmgr

References · 9

• 🔥 http://retrogod.altervista.org/docmgr_0542_incl_xpl.html · Exploit
• 🔥 https://exploit-db.com/exploits/1491 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2006-0687 · Security Note
• http://secunia.com/advisories/18803 · Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/24694 · Note
• http://vupen.com/english/advisories/2006/0544 · Note
• http://securityfocus.com/bid/16601 · Note
• http://securityfocus.com/archive/1/424818/100/0/threaded · Note
• http://securityreason.com/securityalert/428 · Note