PT-2006-5248 · Interact · Interact

Kacper · Published 2006-08-30 · Updated 2018-10-17 · CVE-2006-4448

Positive Technologies (AI Summary)

CVSS v2.0

5.1

Medium

Base vector

AV:N/AC:H/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions interact version 2.2

Description The issue allows remote attackers to execute arbitrary PHP code via specific parameters in certain files when register globals is enabled. This can be achieved by manipulating the CONFIG[BASE PATH] parameter in files such as admin/autoprompter.php and includes/common.inc.php, and the CONFIG[LANGUAGE CPATH] parameter in admin/autoprompter.php.

Recommendations For interact version 2.2, consider disabling the register globals setting to prevent exploitation. Additionally, restrict access to the admin/autoprompter.php and includes/common.inc.php files to minimize the risk of arbitrary PHP code execution. Avoid using the CONFIG[BASE PATH] and CONFIG[LANGUAGE CPATH] parameters in the affected files until the issue is resolved.

Exploit

Fix

Related Identifiers

CVE-2006-4448

Affected Products

Interact

References · 6

• 🔥 http://securityfocus.com/bid/19739 · Exploit
• 🔥 https://exploit-db.com/exploits/2218 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2006-4448 · Security Note
• http://securityreason.com/securityalert/1471 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/28485 · Note
• http://securityfocus.com/archive/1/444526/100/0/threaded · Note