PT-2006-4079 · Asp · Asp Stats Generator

Hamid Ebadi · Published 2006-06-23 · Updated 2017-10-19 · CVE-2006-3184

Positive Technologies (AI Summary)

CVSS v2.0

4.0

Medium

Base vector

AV:N/AC:L/Au:S/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions ASP Stats Generator versions prior to 2.1.2

Description A direct static code injection issue allows remote authenticated attackers to execute arbitrary ASP code. This is achieved via the strAsgSknPageBgColour parameter to the "settings skin.asp" endpoint, with the malicious code being stored in "inc skin file.asp".

Recommendations For versions prior to 2.1.2, update to version 2.1.2 or later to resolve the issue. As a temporary workaround, consider restricting access to the "settings skin.asp" endpoint and avoid using the strAsgSknPageBgColour parameter until the issue is resolved.

Exploit

Fix

Related Identifiers

CVE-2006-3184

Affected Products

Asp Stats Generator

References · 7

• 🔥 https://exploit-db.com/exploits/1931 · Exploit
• http://secunia.com/advisories/20721 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2006-3184 · Security Note
• http://vupen.com/english/advisories/2006/2414 · Note
• http://hamid.ir/security/aspstats.txt · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/27284 · Note
• http://blog.asp-stats.com/index.php/2006/06/18/asp-stats-generator-v212 · Note