PT-2006-3477 · Snitz Forums · Avatar Mod

Published 2006-05-22 · Updated 2018-10-18 · CVE-2006-2530

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Avatar MOD versions 1.3 and possibly other versions for Snitz Forums 3.4

Description The issue allows remote attackers to bypass file type checks and upload arbitrary files via a null byte in the file name.

Recommendations For Avatar MOD version 1.3, consider restricting file uploads or validating file names to prevent null byte injection until a patch is available. For other possibly affected versions of Avatar MOD, restrict file uploads or validate file names to prevent null byte injection until a patch is available.

Exploit

Fix

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2006-2530

Affected Products

Avatar Mod

References · 8

• 🔥 http://codescan.com/Advisories/CodeScanLabs_AvatarMod.html · Exploit
• http://secunia.com/advisories/20148 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2006-2530 · Security Note
• http://securityfocus.com/bid/18014 · Note
• http://security-assessment.com/Whitepapers/0x00_vs_ASP_File_Uploads.pdf · Note
• http://vupen.com/english/advisories/2006/1854 · Note
• http://securityfocus.com/archive/1/434366/100/0/threaded · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/26546 · Note