PT-2006-5835 · Net2Ftp · Net2Ftp

Steven M. Christey · Published 2006-09-29 · Updated 2024-08-07 · CVE-2006-5097

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions net2ftp versions 0.1 through 0.62

Description A remote file inclusion issue in index.php allows remote attackers to execute arbitrary PHP code via a URL in the application rootdir parameter. However, this issue has been disputed by a third-party researcher and the vendor, who claims that the variable is set in settings.inc.php and thus is not a vulnerability.

Recommendations For net2ftp versions 0.1 through 0.62, consider restricting access to the application rootdir parameter to minimize the risk of exploitation. However, given the dispute over the issue, it is essential to review the settings.inc.php file to understand how the application rootdir variable is handled. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2006-5097

Affected Products

Net2Ftp

References · 12

• https://nvd.nist.gov/vuln/detail/CVE-2006-5097 · Security Note
• http://securityfocus.com/archive/1/447535/100/0/threaded · Note
• http://attrition.org/pipermail/vim/2006-October/001077.html · Note
• http://attrition.org/pipermail/vim/2006-October/001076.html · Note
• http://securityfocus.com/archive/1/448037/100/0/threaded · Note
• http://securityreason.com/securityalert/1655 · Note
• http://securityfocus.com/archive/1/447916/100/0/threaded · Note
• http://securityfocus.com/archive/1/447156/100/0/threaded · Note
• http://net2ftp.org/forums/viewtopic.php?pid=6687 · Note
• http://net2ftp.org/forums/viewtopic.php?pid=6689 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/29203 · Note
• http://net2ftp.org/forums/viewtopic.php?pid=6676 · Note