PT-2006-4000 · Apache+1 · Mod Mime+2

Rgod · Published 2006-06-21 · Updated 2018-10-18 · CVE-2006-3102

Positive Technologies (AI Summary)

CVSS v2.0

5.1

Medium

Base vector

AV:N/AC:H/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Bitweaver version 1.3

Description A race condition exists in the articles/BitArticle.php file of Bitweaver, allowing remote attackers to execute arbitrary PHP code when run on Apache with the mod mime extension. This is achieved by uploading files with double extensions, which are temporarily stored under the webroot in the temp/articles directory.

Recommendations For Bitweaver version 1.3, consider restricting access to the temp/articles directory or implementing validation to prevent uploads of files with double extensions as a temporary workaround until a patch is available.

Exploit

Fix

Related Identifiers

CVE-2006-3102

Affected Products

Apache

Bitweaver

Mod Mime

References · 12

• 🔥 http://secunia.com/advisories/20695 · Exploit
• 🔥 https://exploit-db.com/exploits/1918 · Exploit
• 🔥 http://retrogod.altervista.org/bitweaver_13_xpl.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2006-3102 · Security Note
• http://bitweaver.org/articles/45 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/27215 · Note
• http://securityreason.com/securityalert/1115 · Note
• http://securityfocus.com/archive/1/437491/100/0/threaded · Note
• http://sourceforge.net/project/shownotes.php?release_id=336854&group_id=141358 · Note
• http://vupen.com/english/advisories/2006/2405 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3102 · Note
• http://osvdb.org/26587 · Note