PT-2006-2608 · Squery · Osquery

Uid0 · Published 2006-04-04 · Updated 2018-10-18 · CVE-2006-1610

Positive Technologies (AI Summary)

CVSS v2.0

5.1

Medium

Base vector

AV:N/AC:H/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions: SQuery versions 4.5 and earlier

Description: The issue allows remote attackers to execute arbitrary PHP code via a URL in the libpath parameter. This occurs when register globals is disabled.

Recommendations: For SQuery versions 4.5 and earlier, consider disabling the libpath parameter or restricting its use until a patch is available. Additionally, enabling register globals may prevent the issue, but this should be done with caution due to potential security implications of enabling this setting. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2006-1610

Affected Products

Osquery

References · 8

• 🔥 https://exploit-db.com/exploits/1629 · Exploit
• 🔥 http://securityfocus.com/bid/17434 · Exploit
• http://vupen.com/english/advisories/2006/1204 · Vendor Advisory
• http://secunia.com/advisories/19482 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2006-1610 · Security Note
• http://securityfocus.com/archive/1/429611/100/0/threaded · Note
• http://osvdb.org/24400 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/25605 · Note