PT-2006-4014 · Phpraid · Phpraid

Published 2006-06-29 · Updated 2017-07-20 · CVE-2006-3116

Positive Technologies (AI Summary)

CVSS v2.0

5.1

Medium

Base vector

AV:N/AC:H/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions phpRaid versions 3.0.4 through 3.0.5

Description The issue allows remote attackers to execute arbitrary code via a URL in the phpraid dir parameter to various PHP files, including 'configuration.php', 'guilds.php', 'index.php', 'locations.php', 'login.php', 'lua output.php', 'permissions.php', 'profile.php', 'raids.php', 'register.php', 'roster.php', and 'view.php'.

Recommendations For phpRaid version 3.0.4, update to a version that fixes the remote file inclusion issue. For phpRaid version 3.0.5, update to a version that fixes the remote file inclusion issue. As a temporary workaround, consider restricting access to the phpraid dir parameter in the affected PHP files until a patch is available.

Fix

Related Identifiers

CVE-2006-3116

Affected Products

Phpraid

References · 19

• http://secunia.com/secunia_research/2006-47/advisory · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2006-3116 · Security Note
• http://secunia.com/advisories/20200 · Vendor Advisory
• http://osvdb.org/26901 · Note
• http://osvdb.org/26895 · Note
• http://osvdb.org/26892 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/27465 · Note
• http://osvdb.org/26894 · Note
• http://archives.neohapsis.com/archives/fulldisclosure/2006-06/0824.html · Note
• http://osvdb.org/26891 · Note
• http://osvdb.org/26900 · Note
• http://osvdb.org/26893 · Note
• http://securityfocus.com/bid/18719 · Note
• http://osvdb.org/26897 · Note
• http://osvdb.org/26896 · Note