PT-2006-2485 · Php · Php Live Helper

Published 2006-03-29 · Updated 2018-10-18 · CVE-2006-1477

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions PHP Live Helper version 1.8

Description The issue allows remote attackers to include and execute arbitrary PHP code. This is achieved via the abs path parameter in several PHP files, including "initiate.php", "waiting.php", "welcome.php", "admin/index.php", "javascript.php", "checkchat.php", and "blank.php".

Recommendations For PHP Live Helper version 1.8, consider restricting access to the abs path parameter in the affected PHP files until a patch is available. As a temporary workaround, disabling the execution of arbitrary PHP code in these files can help minimize the risk of exploitation.

Exploit

Fix

Related Identifiers

CVE-2006-1477

Affected Products

Php Live Helper

References · 17

• 🔥 http://worlddefacers.de/Public/WD-TMPLH.txt · Exploit
• 🔥 http://secunia.com/advisories/19428 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2006-1477 · Security Note
• http://turnkeywebtools.com/forum/showthread.php?p=10415 · Patch
• http://osvdb.org/24193 · Note
• http://securityfocus.com/archive/1/437648/100/0/threaded · Note
• http://osvdb.org/24199 · Note
• http://osvdb.org/24196 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/25489 · Note
• http://osvdb.org/24198 · Note
• http://securityfocus.com/archive/1/437741/100/0/threaded · Note
• http://osvdb.org/24197 · Note
• http://osvdb.org/24195 · Note
• http://vupen.com/english/advisories/2006/1137 · Note
• http://securityfocus.com/archive/1/428976/100/0/threaded · Note