PT-2006-4067 · Content*Builder · Content*Builder

Federico Fazzi

·

Published

2006-06-23

·

Updated

2017-07-20

·

CVE-2006-3172

CVSS v2.0

7.5

High

VectorAV:N/AC:L/Au:N/C:P/I:P/A:P
Name of the Vulnerable Software and Affected Versions Content*Builder version 0.7.5
Description The issue allows remote attackers to execute arbitrary PHP code via a URL with a trailing slash (/) character in several parameters, including lang path, path[cb], and rel, across multiple PHP files within the Content*Builder application. This affects various modules and plugins, such as column.inc.php, poll.inc.php, user.inc.php, media.inc.php, events.inc.php, newsletter.inc.php, guestbook.inc.php, shoutBox.php, sitemap.inc.php, overview.inc.php, detailView.inc.php, fullarticle.inc.php, comments.inc.php, headlineBox.php, and showHeadline.inc.php.
Recommendations For Content*Builder version 0.7.5, consider disabling the vulnerable parameters lang path, path[cb], and rel in the affected PHP files until a patch is available. Restrict access to the vulnerable modules and plugins to minimize the risk of exploitation. Avoid using the affected parameters in the respective API endpoints, such as '/cms/plugins/col man/column.inc.php', '/modules/guestbook/guestbook.inc.php', and '/modules/download/overview.inc.php', until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Code Injection

Found an issue in the description? Have something to add? Feel free to write us 👾

Weakness Enumeration

Related Identifiers

CVE-2006-3172

Affected Products

Content*Builder