PT-2006-3918 · Phpbannerexchange · Phpbannerexchange

Published 2006-06-19 · Updated 2018-10-18 · CVE-2006-3013

Positive Technologies (AI Summary)

CVSS v2.0

5.1

Medium

Base vector

AV:N/AC:H/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions phpBannerExchange versions prior to 2.0 Update 6

Description The issue arises from an interpretation conflict in the resetpw.php file, allowing remote attackers to execute arbitrary SQL commands. This is achieved by including a null (%00) character after a valid e-mail address in the email parameter, which bypasses the validation check performed by the eregi PHP command.

Recommendations For versions prior to 2.0 Update 6, consider updating to version 2.0 Update 6 or later to resolve the issue. As a temporary workaround, restrict the use of the email parameter in the resetpw.php file to prevent potential SQL command execution.

Exploit

Fix

Related Identifiers

CVE-2006-3013

Affected Products

Phpbannerexchange

References · 10

• 🔥 http://eschew.net/scripts/phpbe/2.0/releasenotes.php · Exploit
• http://securityfocus.com/bid/18448 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2006-3013 · Security Note
• http://secunia.com/advisories/20687 · Vendor Advisory
• http://redteam-pentesting.de/advisories/rt-sa-2006-005.txt · Note
• http://lists.grok.org.uk/pipermail/full-disclosure/2006-June/046953.html · Note
• http://vupen.com/english/advisories/2006/2358 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/27193 · Note
• http://osvdb.org/26509 · Note
• http://securityfocus.com/archive/1/437294/100/0/threaded · Note