PT-2006-4067 · Content*Builder · Content*Builder
Federico Fazzi
·
Published
2006-06-23
·
Updated
2017-07-20
·
CVE-2006-3172
CVSS v2.0
7.5
High
| Vector | AV:N/AC:L/Au:N/C:P/I:P/A:P |
Name of the Vulnerable Software and Affected Versions
Content*Builder version 0.7.5
Description
The issue allows remote attackers to execute arbitrary PHP code via a URL with a trailing slash (/) character in several parameters, including
lang path, path[cb], and rel, across multiple PHP files within the Content*Builder application. This affects various modules and plugins, such as column.inc.php, poll.inc.php, user.inc.php, media.inc.php, events.inc.php, newsletter.inc.php, guestbook.inc.php, shoutBox.php, sitemap.inc.php, overview.inc.php, detailView.inc.php, fullarticle.inc.php, comments.inc.php, headlineBox.php, and showHeadline.inc.php.Recommendations
For Content*Builder version 0.7.5, consider disabling the vulnerable parameters
lang path, path[cb], and rel in the affected PHP files until a patch is available. Restrict access to the vulnerable modules and plugins to minimize the risk of exploitation. Avoid using the affected parameters in the respective API endpoints, such as '/cms/plugins/col man/column.inc.php', '/modules/guestbook/guestbook.inc.php', and '/modules/download/overview.inc.php', until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.Exploit
Code Injection
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Content*Builder