PT-2006-5252 · Web3News · Web3News

Shikaa · Published 2006-08-30 · Updated 2017-10-19 · CVE-2006-4452

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Web3news versions 0.95 and earlier

Description The issue allows remote attackers to execute arbitrary PHP code when register globals is enabled. This is achieved via a URL in the PHPSECURITYADMIN PATH parameter.

Recommendations For Web3news versions 0.95 and earlier, disable the register globals setting to prevent exploitation. As a temporary workaround, consider restricting access to the security/include/ class.security.php file until a patch is available. Avoid using the PHPSECURITYADMIN PATH parameter in affected URLs until the issue is resolved.

Exploit

Fix

Related Identifiers

CVE-2006-4452

Affected Products

Web3News

References · 7

• 🔥 https://exploit-db.com/exploits/2269 · Exploit
• 🔥 http://securityfocus.com/bid/19744 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2006-4452 · Security Note
• http://secunia.com/advisories/21640 · Vendor Advisory
• http://vupen.com/english/advisories/2006/3407 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/28618 · Note
• http://osvdb.org/28248 · Note