PT-2006-1835 · Php · Phpkit

Rgod · Published 2006-02-19 · Updated 2018-10-18 · CVE-2006-0786

Positive Technologies (AI Summary)

CVSS v2.0

5.1

Medium

Base vector

AV:N/AC:H/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions PHPKIT versions 1.6.1 Release 2 and earlier

Description The issue allows remote attackers to conduct PHP remote file include attacks via a path parameter. This can be achieved by specifying a (1) UNC share or (2) ftps URL, which bypasses the check for "http://", "ftp://", and "https://" URLs. This is possible when allow url fopen is enabled.

Recommendations For PHPKIT versions 1.6.1 Release 2 and earlier, consider disabling the allow url fopen setting to prevent remote file inclusion attacks. Additionally, restrict access to the include.php file to minimize the risk of exploitation.

Exploit

Fix

Related Identifiers

CVE-2006-0786

Affected Products

Phpkit

References · 7

• 🔥 https://exploit-db.com/exploits/1501 · Exploit
• 🔥 http://retrogod.altervista.org/phpkit_161r2_incl_xpl.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2006-0786 · Security Note
• http://securityfocus.com/archive/1/425196/100/0/threaded · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-0786 · Note
• http://securityreason.com/securityalert/445 · Note
• http://securitytracker.com/id?1015640 · Note