PT-2006-4735 · Gonafish · Gonafish Linkscaffe

Simo64 · Published 2006-07-27 · Updated 2018-10-17 · CVE-2006-3884

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Gonafish LinksCaffe version 3.0

Description The issue allows remote attackers to execute arbitrary SQL commands via the offset and limit parameters, newdays parameter in a new action, and the link id parameter in a deadlink action. This can also be used for path disclosure by forcing a SQL error or to modify PHP files using OUTFILE.

Recommendations For Gonafish LinksCaffe version 3.0, consider restricting access to the links.php file and validating user input for the offset, limit, newdays, and link id parameters to prevent SQL injection attacks. As a temporary workaround, consider disabling the links.php file until a patch is available.

Exploit

Fix

Related Identifiers

CVE-2006-3884

Affected Products

Gonafish Linkscaffe

References · 11

• 🔥 https://exploit-db.com/exploits/28267 · Exploit
• 🔥 http://securityfocus.com/bid/19149 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2006-3884 · Security Note
• http://vupen.com/english/advisories/2006/2983 · Note
• http://securitytracker.com/id?1016584 · Note
• http://securityfocus.com/archive/1/441087/100/0/threaded · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/27962 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/27961 · Note
• http://osvdb.org/27518 · Note
• http://securityreason.com/securityalert/1287 · Note
• http://secunia.com/advisories/21212 · Note