PT-2006-2989 · Clansys · Clansys

Mustafa Can Bjorn Ipekci + 1 · Published 2006-04-25 · Updated 2018-10-18 · CVE-2006-2005

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions ClanSys version 1.1

Description The issue allows remote attackers to execute arbitrary PHP code via PHP code in the page parameter. This is achieved by injecting an "include" statement into the eval statement, demonstrating the eval injection vulnerability. It's worth noting that some sources describe this issue as file inclusion, but the primary concern is the eval injection itself.

Recommendations For ClanSys version 1.1, consider disabling the eval statement in index.php to prevent arbitrary PHP code execution until a patch is available. Restrict access to the page parameter to minimize the risk of exploitation.

Exploit

Fix

Related Identifiers

CVE-2006-2005

Affected Products

Clansys

References · 9

• 🔥 http://nukedx.com/?getxpl=29 · Exploit
• 🔥 https://exploit-db.com/exploits/1710 · Exploit
• 🔥 http://securitytracker.com/id?1015988 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2006-2005 · Security Note
• http://osvdb.org/25083 · Note
• http://securityfocus.com/bid/17660 · Note
• http://securityreason.com/securityalert/782 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/25976 · Note
• http://securityfocus.com/archive/1/431873/100/0/threaded · Note