PT-2006-3542 · Artmedic · Artmedic Newsletter

Published 2006-05-26 · Updated 2011-03-08 · CVE-2006-2609

Positive Technologies (AI Summary)

CVSS v2.0

5.1

Medium

Base vector

AV:N/AC:H/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions artmedic newsletter versions 4.1.2 and possibly other versions

Description The issue allows remote attackers to modify arbitrary files and execute arbitrary PHP code when the register globals setting is enabled. This is achieved via the email parameter to the "newsletter log.php" endpoint.

Recommendations For version 4.1.2, consider disabling the register globals setting to prevent exploitation. As a temporary workaround, restrict access to the "newsletter log.php" endpoint until a patch is available. Avoid using the email parameter in the affected endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2006-2609

Affected Products

Artmedic Newsletter

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2006-2609 · Security Note
• http://secunia.com/advisories/20204 · Vendor Advisory
• http://vupen.com/english/advisories/2006/1930 · Note