PT-2006-4907 · Csaba Godor · Csaba Godor Sapid Blog

Kacper · Published 2006-08-10 · Updated 2017-10-19 · CVE-2006-4063

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Csaba Godor SAPID Blog versions Beta 2 and earlier

Description The issue allows remote attackers to execute arbitrary PHP code. This can be achieved via a URL in the root path parameter to specific PHP files, such as usr/extensions/get blog infochannel.inc.php, usr/extensions/get blog meta info.inc.php, or usr/extensions/get infochannel.inc.php. Alternatively, it can be done through the GLOBALS[root path] parameter to usr/extensions/get tree.inc.php.

Recommendations For Csaba Godor SAPID Blog versions Beta 2 and earlier, consider disabling access to the usr/extensions directory until a patch is available. Restrict the use of the root path and GLOBALS[root path] parameters in the affected PHP files to minimize the risk of exploitation. Avoid using these parameters in the specified API endpoints until the issue is resolved.

Exploit

Fix

Related Identifiers

CVE-2006-4063

Affected Products

Csaba Godor Sapid Blog

References · 7

• 🔥 https://exploit-db.com/exploits/2130 · Exploit
• 🔥 https://exploit-db.com/exploits/2129 · Exploit
• 🔥 https://exploit-db.com/exploits/2131 · Exploit
• 🔥 https://exploit-db.com/exploits/2128 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2006-4063 · Security Note
• http://vupen.com/english/advisories/2006/3196 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/28251 · Note