PT-2006-5096 · Nes+1 · Nes System+2

Kacper + 1 · Published 2006-08-22 · Updated 2017-10-19 · CVE-2006-4287

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions NES Game and NES System version c108122 and earlier

Description The issue allows remote attackers to execute arbitrary PHP code via a URL in the phphtmllib parameter to various scripts, including includes.php, divtag utils.php, form utils.php, html utils.php, localinc.php, FooterNav.php, HTMLPageClass.php, InfoTable.php, NavTable.php, and TextNav.php.

Recommendations For NES Game and NES System version c108122 and earlier, consider disabling the phphtmllib parameter in the affected scripts until a patch is available. Restrict access to the vulnerable scripts to minimize the risk of exploitation. Avoid using the phphtmllib parameter in the affected API endpoints until the issue is resolved.

Exploit

Fix

Related Identifiers

CVE-2006-4287

Affected Products

Nes Game

Nes System

Phphtmllib

References · 18

• 🔥 http://securityfocus.com/bid/19611 · Exploit
• 🔥 http://rahim.webd.pl/exploity/Exploits/61.html · Exploit
• 🔥 https://exploit-db.com/exploits/2226 · Exploit
• 🔥 http://secunia.com/advisories/21593 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2006-4287 · Security Note
• http://osvdb.org/28048 · Note
• http://osvdb.org/28050 · Note
• http://osvdb.org/28045 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/28486 · Note
• http://osvdb.org/28049 · Note
• http://osvdb.org/28044 · Note
• http://vupen.com/english/advisories/2006/3339 · Note
• http://osvdb.org/28047 · Note
• http://osvdb.org/28052 · Note
• http://osvdb.org/28046 · Note