PT-2006-1776 · Reamday Enterprises · Magic News Lite

Aliaksandr Hartsuyeu · Published 2006-02-16 · Updated 2017-07-20 · CVE-2006-0724

Positive Technologies (AI Summary)

CVSS v2.0

2.6

Low

Base vector

AV:N/AC:H/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Reamday Enterprises Magic News Lite version 1.2.3

Description The issue allows remote attackers to modify program behavior, potentially bypassing authentication controls, when register globals is enabled. This is achieved via modified variables, including action, passwd, admin password, new passwd, and confirm passwd, which are not initialized.

Recommendations For Reamday Enterprises Magic News Lite version 1.2.3, consider disabling the register globals setting to prevent exploitation. Additionally, as a temporary workaround, restrict access to the profile.php file until a patch is available. Avoid using the action, passwd, admin password, new passwd, and confirm passwd variables in the profile.php file until the issue is resolved.

Fix

Related Identifiers

CVE-2006-0724

Affected Products

Magic News Lite

References · 6

• http://secunia.com/advisories/18878 · Vendor Advisory
• http://evuln.com/vulns/72/summary.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2006-0724 · Security Note
• http://securityfocus.com/bid/16665 · Note
• http://vupen.com/english/advisories/2006/0603 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/24610 · Note