PT-2006-5631 · David Bennett · Php-Post

Hackers Pal · Published 2006-09-19 · Updated 2018-10-17 · CVE-2006-4877

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions David Bennett PHP-Post (PHPp) versions 1.0 and earlier

Description The issue allows remote attackers to overwrite arbitrary program variables via multiple vectors that use the extract function. This is demonstrated by the table prefix parameter in various PHP files, including "index.php", "profile.php", and "header.php".

Recommendations For David Bennett PHP-Post (PHPp) versions 1.0 and earlier, consider disabling the use of the extract function until a patch is available. Restrict access to the table prefix parameter in the affected PHP files to minimize the risk of exploitation.

Exploit

Fix

Related Identifiers

CVE-2006-4877

Affected Products

Php-Post

References · 10

• 🔥 https://exploit-db.com/exploits/28591 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2006-4877 · Security Note
• http://osvdb.org/28965 · Note
• http://securityreason.com/securityalert/1607 · Note
• http://osvdb.org/28967 · Note
• http://osvdb.org/28966 · Note
• http://vupen.com/english/advisories/2006/3688 · Note
• http://securityfocus.com/bid/20061 · Note
• http://secunia.com/advisories/22014 · Note
• http://securityfocus.com/archive/1/446318/100/0/threaded · Note