PT-2006-1927 · Noah · Noah'S Classifieds

Published 2006-02-24 · Updated 2018-10-18 · CVE-2006-0881

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Noah's Classifieds version 1.3

Description The issue allows remote attackers to include arbitrary PHP files due to multiple PHP remote file include vulnerabilities in gorum/gorumlib.php. This is possible when register globals is enabled, and it can be exploited via the upperTemplate and lowerTemplate parameters. For example, an attacker can use the lowerTemplate parameter to include arbitrary PHP files in index.php.

Recommendations For Noah's Classifieds version 1.3, consider disabling the register globals setting to prevent exploitation. Additionally, restrict access to the upperTemplate and lowerTemplate parameters in gorum/gorumlib.php to minimize the risk of arbitrary PHP file inclusion.

Exploit

Fix

Related Identifiers

CVE-2006-0881

Affected Products

Noah'S Classifieds

References · 8

• 🔥 http://kapda.ir/advisory-268.html · Exploit
• 🔥 https://exploit-db.com/exploits/27262 · Exploit
• 🔥 http://securityfocus.com/bid/16780 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2006-0881 · Security Note
• http://securityfocus.com/archive/1/425783/100/0/threaded · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/24899 · Note
• http://securitytracker.com/id?1015667 · Note
• http://vupen.com/english/advisories/2006/0703 · Note