PT-2006-2176 · Owl · Owl Intranet Engine

Rgod · Published 2006-03-10 · Updated 2017-10-19 · CVE-2006-1149

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions OWL Intranet Engine version 0.82

Description The issue allows remote attackers to include arbitrary files via a URL in the xrms file root parameter, which is not initialized before use, when register globals is enabled. This can be exploited by providing a malicious URL as the xrms file root parameter.

Recommendations For OWL Intranet Engine version 0.82, consider disabling the register globals setting to prevent exploitation. Additionally, restrict access to the lib/OWL API.php file to minimize the risk of arbitrary file inclusion. Avoid using the xrms file root parameter until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Related Identifiers

CVE-2006-1149

Affected Products

Owl Intranet Engine

References · 8

• 🔥 https://exploit-db.com/exploits/1561 · Exploit
• 🔥 http://osvdb.org/23734 · Exploit
• 🔥 http://secunia.com/advisories/19142 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2006-1149 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/25082 · Note
• http://vupen.com/english/advisories/2006/0868 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-1149 · Note
• http://securityfocus.com/bid/17021 · Note