PT-2006-2653 · Chucky A. Ivey · Chucky A. Ivey N.T.

Aliaksandr Hartsuyeu · Published 2006-04-07 · Updated 2018-10-18 · CVE-2006-1658

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions: Chucky A. Ivey N.T. version 1.1.0

Description: A direct static code injection issue exists, allowing remote administrators to insert arbitrary PHP code into the config file through the ticker.db.php script. This code is then included in other N.T. scripts, potentially leading to exploitation.

Recommendations: For Chucky A. Ivey N.T. version 1.1.0, consider restricting access to the ticker.db.php script to prevent remote administrators from injecting arbitrary PHP code until a fix is available. As a temporary workaround, avoid using the config file inclusion in other N.T. scripts to minimize the risk of exploitation.

Fix

Related Identifiers

CVE-2006-1658

Affected Products

Chucky A. Ivey N.T.

References · 8

• http://secunia.com/advisories/19526 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2006-1658 · Security Note
• http://vupen.com/english/advisories/2006/1243 · Note
• http://securityfocus.com/bid/17387 · Note
• http://securityfocus.com/archive/1/431344/100/0/threaded · Note
• http://evuln.com/vulns/121/summary.html · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/25639 · Note
• http://osvdb.org/24398 · Note