PT-2006-5649 · Idevspot · Nexieaffiliate

S3Rv3R_Hack3R · Published 2006-09-19 · Updated 2018-10-17 · CVE-2006-4895

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions IDevSpot NexieAffiliate versions 1.9 and earlier

Description The issue allows remote attackers to delete arbitrary affiliates. This is achieved by modifying the id parameter in the "delete.php" endpoint.

Recommendations For versions 1.9 and earlier, restrict access to the "delete.php" endpoint to prevent unauthorized affiliate deletion. As a temporary workaround, consider validating and sanitizing the id parameter to ensure only authorized modifications can be made.

Exploit

Fix

Related Identifiers

CVE-2006-4895

Affected Products

Nexieaffiliate

References · 5

• 🔥 http://securityfocus.com/bid/20086 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2006-4895 · Security Note
• http://securityfocus.com/archive/1/446306/100/0/threaded · Note
• http://secunia.com/advisories/22063 · Note
• http://securityreason.com/securityalert/1616 · Note