PT-2006-4868 · Flant+1 · Minibb+1

Published 2006-08-08 · Updated 2018-10-17 · CVE-2006-4023

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions PHP versions 5.1.4 and earlier

Description The ip2long function in PHP may incorrectly validate an arbitrary string and return a valid network IP address. This allows remote attackers to obtain network information and facilitate other attacks, such as SQL injection in the X-FORWARDED-FOR Header. The issue is demonstrated in MiniBB 2.0, where it can be exploited using the index.php file.

Recommendations For PHP versions 5.1.4 and earlier, consider updating to a newer version to mitigate the risk. As a temporary workaround, restrict the use of the ip2long function in security-relevant contexts to minimize the risk of exploitation. Avoid using the ip2long function with untrusted input, such as the X-FORWARDED-FOR Header, until the issue is resolved.

Exploit

Fix

Related Identifiers

CVE-2006-4023

Affected Products

Minibb

Php

References · 8

• 🔥 http://securitytracker.com/id?1016609 · Exploit
• 🔥 http://retrogod.altervista.org/php_ip2long.htm · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2006-4023 · Security Note
• http://securityfocus.com/archive/1/441708/100/100/threaded · Note
• http://securityfocus.com/archive/1/archive/1/441708/100/100/threaded · Note
• http://securityfocus.com/archive/1/archive/1/441529/100/100/threaded · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-4023 · Note
• http://securityfocus.com/archive/1/441529/100/100/threaded · Note