PT-2006-3947 · Ispconfig · Ispconfig

Federico Fazzi · Published 2006-06-15 · Updated 2024-08-07 · CVE-2006-3042

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions ISPConfig version 2.2.3

Description Multiple PHP remote file inclusion issues allow remote attackers to execute arbitrary PHP code via a URL in the go info[isp][classes root] parameter in server.inc.php, and the go info[server][classes root] parameter in app.inc.php, login.php, and trylogin.php. The vendor has disputed this issue, stating that the original researcher reviewed the installation tarball, which is not identical to the resulting system after installation.

Recommendations For ISPConfig version 2.2.3, consider disabling the go info[isp][classes root] and go info[server][classes root] parameters in the affected files until a patch is available. Restrict access to the vulnerable parameters to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Related Identifiers

CVE-2006-3042

Affected Products

Ispconfig

References · 9

• 🔥 http://securityfocus.com/bid/18441 · Exploit
• 🔥 https://exploit-db.com/exploits/28027 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2006-3042 · Security Note
• http://securityfocus.com/archive/1/437415/100/100/threaded · Note
• https://t.me/cvenotify/89782 · Telegram Post
• http://osvdb.org/27474 · Note
• http://securityreason.com/securityalert/1098 · Note
• http://securityfocus.com/archive/1/437117/100/0/threaded · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3042 · Note