PT-2006-1836 · Plaino · Plaino Wimpy Mp3 Player

Published 2006-02-19 · Updated 2017-07-20 · CVE-2006-0787

Positive Technologies (AI Summary)

CVSS v2.0

4.0

Medium

Base vector

AV:N/AC:H/Au:N/C:N/I:P/A:P

Name of the Vulnerable Software and Affected Versions Plaino Wimpy MP3 Player versions 5.2 and earlier

Description The issue allows remote attackers to insert arbitrary strings into trackme.txt via the trackFile, trackArtist, and trackTitle parameters. This can result in providing false information about songs, occupying excessive disk space with very long parameter values, and potentially storing executable code that might be invoked through a different vulnerability.

Recommendations For versions 5.2 and earlier, consider restricting access to the wimpy trackplays.php file to minimize the risk of exploitation. As a temporary workaround, avoid using the trackFile, trackArtist, and trackTitle parameters in the affected API endpoint until the issue is resolved.

Exploit

Fix

Related Identifiers

CVE-2006-0787

Affected Products

Plaino Wimpy Mp3 Player

References · 6

• 🔥 http://securityfocus.com/bid/16696 · Exploit
• 🔥 http://xorcrew.net/xpa/XPA-WimpyMP3Player.txt · Exploit
• 🔥 https://exploit-db.com/exploits/27244 · Exploit
• http://secunia.com/advisories/18900 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2006-0787 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/24770 · Note