PT-2006-1774 · Reamday Enterprises · Magic Downloads

Aliaksandr Hartsuyeu · Published 2006-02-16 · Updated 2018-10-19 · CVE-2006-0722

Positive Technologies (AI Summary)

CVSS v2.0

2.6

Low

Base vector

AV:N/AC:H/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Reamday Enterprises Magic Downloads version 1.1.3

Description The issue allows remote attackers to modify program behavior, potentially bypassing authentication controls, when register globals is enabled. This is achieved via modified variables, including action, passwd, admin password, new passwd, and confirm passwd, which are not initialized.

Recommendations For Reamday Enterprises Magic Downloads version 1.1.3, consider disabling the register globals setting to prevent exploitation. Additionally, initialize all variables, including action, passwd, admin password, new passwd, and confirm passwd, to prevent unauthorized modification of program behavior.

Fix

Related Identifiers

CVE-2006-0722

Affected Products

Magic Downloads

References · 8

• http://secunia.com/advisories/18877 · Vendor Advisory
• http://evuln.com/vulns/73/summary.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2006-0722 · Security Note
• http://securityfocus.com/bid/16665 · Note
• http://vupen.com/english/advisories/2006/0602 · Note
• http://securityreason.com/securityalert/468 · Note
• http://securityfocus.com/archive/1/425601/30/6830/threaded · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/24615 · Note