PT-2006-5028 · Phpay · Phpay

Beford · Published 2006-08-17 · Updated 2017-10-19 · CVE-2006-4210

Positive Technologies (AI Summary)

CVSS v2.0

2.6

Low

Base vector

AV:N/AC:H/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions phPay versions 2.02 through 2.02.1

Description The issue allows remote attackers to use the server as an open mail relay. This is possible when the register globals setting is enabled, and attackers can modify certain parameters, including mail text2, user row[5], nu mail 1, and shop mail.

Recommendations For phPay versions 2.02 through 2.02.1, disable the register globals setting to prevent exploitation. Additionally, restrict access to the nu mail.inc.php file and avoid using the vulnerable parameters until a fix is available.

Exploit

Fix

Related Identifiers

CVE-2006-4210

Affected Products

Phpay

References · 5

• 🔥 https://exploit-db.com/exploits/2181 · Exploit
• http://secunia.com/advisories/21454 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2006-4210 · Security Note
• http://securityfocus.com/bid/19517 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/28366 · Note