PT-2006-3474 · Phpbazar · Phpbazar

Published 2006-05-22 · Updated 2018-10-18 · CVE-2006-2527

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions phpBazar versions 2.1.0 and earlier

Description The issue allows remote attackers to bypass the authentication process and gain unauthorized access to the administrative section. This is achieved by setting the action parameter to "edit member" and the value parameter to 1 in the "admin/admin.php" endpoint.

Recommendations For phpBazar versions 2.1.0 and earlier, as a temporary workaround, consider restricting access to the "admin/admin.php" endpoint until a patch is available. Avoid using the action parameter set to "edit member" and the value parameter set to 1 in this endpoint to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Related Identifiers

CVE-2006-2527

Affected Products

Phpbazar

References · 9

• 🔥 https://exploit-db.com/exploits/1804 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2006-2527 · Security Note
• http://vupen.com/english/advisories/2006/1890 · Note
• http://securityfocus.com/archive/1/434558/100/0/threaded · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/26617 · Note
• http://secunia.com/advisories/20198 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-2527 · Note
• http://securityfocus.com/bid/18053 · Note
• http://osvdb.org/25701 · Note