PT-2006-3871 · Xtreme Scripts · Xtreme Scripts Download Manager

Black Code + 1 · Published 2006-06-12 · Updated 2018-10-18 · CVE-2006-2964

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Xtreme Scripts Download Manager version 1.0

Description The issue allows remote attackers to execute arbitrary PHP code via a URL in the root parameter in several PHP files, including "download.php", "manager.php", "admin/scripts/category.php", "includes/add allow.php", "admin/index.php", and "admin/admin/login.php".

Recommendations For Xtreme Scripts Download Manager version 1.0, consider disabling the root parameter in the affected PHP files until a patch is available. Restrict access to the vulnerable PHP files to minimize the risk of exploitation. Avoid using the root parameter in the affected API endpoints until the issue is resolved.

Exploit

Fix

Related Identifiers

CVE-2006-2964

Affected Products

Xtreme Scripts Download Manager

References · 11

• 🔥 http://osvdb.org/26644 · Exploit
• 🔥 http://osvdb.org/26645 · Exploit
• 🔥 http://osvdb.org/26646 · Exploit
• 🔥 http://osvdb.org/26643 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2006-2964 · Security Note
• http://osvdb.org/26647 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/26961 · Note
• http://osvdb.org/26648 · Note
• http://securityreason.com/securityalert/1072 · Note
• http://securityfocus.com/archive/1/436107/100/0/threaded · Note
• http://securityfocus.com/archive/1/436104/100/0/threaded · Note