PT-2006-4896 · Turnkey Web Tools · Turnkey Web Tools Php Simple Shop

Ahmad Maulana + 1 · Published 2006-08-10 · Updated 2018-10-17 · CVE-2006-4052

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Turnkey Web Tools PHP Simple Shop versions 2.0 and earlier

Description The issue allows remote attackers to execute arbitrary PHP code via a URL in the abs path parameter to various PHP files, including "admin/index.php", "admin/adminindex.php", "admin/adminglobal.php", "admin/login.php", "admin/menu.php", and "admin/header.php".

Recommendations For Turnkey Web Tools PHP Simple Shop versions 2.0 and earlier, consider restricting access to the abs path parameter in the affected PHP files until a patch is available. As a temporary workaround, avoid using the abs path parameter in the specified API endpoints.

Exploit

Fix

Related Identifiers

CVE-2006-4052

Affected Products

Turnkey Web Tools Php Simple Shop

References · 14

• 🔥 http://advisories.echo.or.id/adv/adv44-matdhule-2006.txt · Exploit
• 🔥 https://exploit-db.com/exploits/2119 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2006-4052 · Security Note
• http://secunia.com/advisories/21371 · Vendor Advisory
• http://osvdb.org/27802 · Note
• http://osvdb.org/27803 · Note
• http://securitytracker.com/id?1016644 · Note
• http://osvdb.org/27804 · Note
• http://osvdb.org/27805 · Note
• http://vupen.com/english/advisories/2006/3171 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/28247 · Note
• http://osvdb.org/27800 · Note
• http://osvdb.org/27801 · Note
• http://securityfocus.com/archive/1/442422/100/100/threaded · Note