PT-2006-2943 · Actual · Actualscripts Server+2

Aesthetico · Published 2006-04-21 · Updated 2018-10-18 · CVE-2006-1959

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions ActualAnalyzer Lite versions 2.72 and earlier ActualScripts Gold versions 7.63 and earlier ActualScripts Server versions 8.23 and earlier

Description The issue allows remote attackers to execute arbitrary code via a URL in the rf parameter. This is a result of a remote file inclusion vulnerability in the direct.php file.

Recommendations For ActualAnalyzer Lite versions 2.72 and earlier, update to a version later than 2.72. For ActualScripts Gold versions 7.63 and earlier, update to a version later than 7.63. For ActualScripts Server versions 8.23 and earlier, update to a version later than 8.23.

Exploit

Fix

Related Identifiers

CVE-2006-1959

Affected Products

Actualanalyzer Lite

Actualscripts Gold

Actualscripts Server

References · 11

• 🔥 https://exploit-db.com/exploits/1767 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2006-1959 · Security Note
• http://securitytracker.com/id?1015967 · Note
• http://securityfocus.com/archive/1/431351/100/0/threaded · Note
• http://vupen.com/english/advisories/2006/1430 · Note
• http://securityfocus.com/bid/17597 · Note
• http://secunia.com/advisories/19743 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/25893 · Note
• http://osvdb.org/24778 · Note
• http://securityfocus.com/archive/1/434562/100/0/threaded · Note
• http://securityreason.com/securityalert/742 · Note