PT-2006-4991 · Chaussette · Chaussette

Drago84 · Published 2006-08-16 · Updated 2017-10-19 · CVE-2006-4159

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Chaussette version 080706 and earlier

Description The issue allows remote attackers to execute arbitrary PHP code via a URL in the BASE parameter to various scripts in the Classes/ directory, including Evenement.php, Event.php, Event for month.php, Event for week.php, My Log.php, My Smarty.php, and possibly Event for month per day.php.

Recommendations For Chaussette version 080706 and earlier, consider restricting access to the vulnerable scripts in the Classes/ directory until a patch is available. As a temporary workaround, avoid using the BASE parameter in the affected scripts.

Exploit

Fix

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2006-4159

Affected Products

Chaussette

References · 12

• 🔥 http://securityfocus.com/bid/19480 · Exploit
• 🔥 http://secunia.com/advisories/21489 · Exploit
• 🔥 https://exploit-db.com/exploits/2169 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2006-4159 · Security Note
• http://vupen.com/english/advisories/2006/3269 · Vendor Advisory
• http://osvdb.org/27901 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/28327 · Note
• http://osvdb.org/27897 · Note
• http://osvdb.org/27898 · Note
• http://osvdb.org/27899 · Note
• http://osvdb.org/27900 · Note
• http://osvdb.org/27902 · Note