PT-2006-3795 · Bookmark4U · Bookmark4U

Selfar2002 · Published 2006-06-07 · Updated 2018-10-18 · CVE-2006-2877

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Bookmark4U versions 2.0.0 and earlier

Description A remote file inclusion issue allows remote attackers to include arbitrary PHP files via the include prefix parameter in several PHP files, including (1) inc/dbase.php, (2) inc/config.php, (3) inc/common.php, and (4) inc/function.php. However, it has been reported that the inc directory is protected by a .htaccess file, which limits the applicability of this issue to certain environments or configurations.

Recommendations For Bookmark4U versions 2.0.0 and earlier, consider restricting access to the include prefix parameter in the affected PHP files until a patch is available. As a temporary workaround, restrict access to the inc directory by reinforcing the .htaccess file protection or applying alternative access control measures to minimize the risk of exploitation.

Exploit

Fix

Related Identifiers

CVE-2006-2877

Affected Products

Bookmark4U

References · 16

• 🔥 https://exploit-db.com/exploits/27974 · Exploit
• 🔥 https://exploit-db.com/exploits/27973 · Exploit
• 🔥 https://exploit-db.com/exploits/27976 · Exploit
• 🔥 https://exploit-db.com/exploits/27975 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2006-2877 · Security Note
• http://securityfocus.com/bid/18281 · Note
• http://securityreason.com/securityalert/1058 · Note
• http://osvdb.org/26600 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/26933 · Note
• http://secunia.com/advisories/19758 · Note
• http://osvdb.org/26602 · Note
• http://osvdb.org/26601 · Note
• http://securitytracker.com/id?1016224 · Note
• http://securityfocus.com/archive/1/436027/100/0/threaded · Note
• http://securityfocus.com/archive/1/435964/100/0/threaded · Note