PT-2006-2810 · Phpwebsite · Phpwebsite

Rgod · Published 2006-04-18 · Updated 2017-10-19 · CVE-2006-1819

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions phpWebSite versions 0.10.2 and earlier

Description The issue allows remote attackers to include arbitrary local files and execute arbitrary PHP code via the hub dir parameter. This can be achieved by including files such as access log. In some cases, under PHP 5, it is possible to perform arbitrary remote file inclusion using an SMB share argument.

Recommendations For phpWebSite versions 0.10.2 and earlier, consider disabling the loadConfig function in index.php until a patch is available. Restrict access to the hub dir parameter to minimize the risk of exploitation. Avoid using the hub dir parameter with untrusted input. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Related Identifiers

CVE-2006-1819

Affected Products

Phpwebsite

References · 10

• 🔥 http://securityfocus.com/bid/17521 · Exploit
• 🔥 https://exploit-db.com/exploits/1673 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2006-1819 · Security Note
• http://gentoo.org/security/en/glsa/glsa-200605-04.xml · Vendor Advisory
• http://downloads.securityfocus.com/vulnerabilities/exploits/PHPWebSite_fi_poc · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/25867 · Note
• http://vupen.com/english/advisories/2006/1361 · Note
• http://securitytracker.com/id?1015942 · Note
• http://secunia.com/advisories/19647 · Note
• http://secunia.com/advisories/19914 · Note