PT-2006-3118 · Php · Php Newsfeed

Aliaksandr Hartsuyeu · Published 2006-05-02 · Updated 2017-07-20 · CVE-2006-2139

Positive Technologies (AI Summary)

CVSS v2.0

6.4

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions PHP Newsfeed version 20040723

Description The issue allows remote attackers to execute arbitrary SQL commands. This can be achieved via various parameters to different PHP files, including the name parameter to 'deltables.php', select, header, url, source, or time parameters to 'manualsubmit.php', num parameter to 'delete.php', or tablename parameter to 'searchnews.php'.

Recommendations For PHP Newsfeed version 20040723, consider restricting access to the vulnerable parameters, such as name, select, header, url, source, time, num, and tablename, in the respective PHP files until a patch is available. As a temporary workaround, avoid using these parameters in the affected API endpoints.

Fix

Related Identifiers

CVE-2006-2139

Affected Products

Php Newsfeed

References · 10

• https://nvd.nist.gov/vuln/detail/CVE-2006-2139 · Security Note
• http://secunia.com/advisories/19904 · Vendor Advisory
• http://evuln.com/vulns/129/summary.html · Note
• http://osvdb.org/25133 · Note
• http://vupen.com/english/advisories/2006/1574 · Note
• http://osvdb.org/25135 · Note
• http://osvdb.org/25134 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/26205 · Note
• http://osvdb.org/25132 · Note
• http://securityfocus.com/bid/17757 · Note