PT-2006-5967 · Isearch · Isearch

Published 2006-10-11 · Updated 2024-08-07 · CVE-2006-5232

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions iSearch version 2.16

Description The issue concerns remote file inclusion vulnerabilities that could allow remote attackers to execute arbitrary PHP code. This is achieved by providing a URL in the isearch path parameter within various PHP files, including 'index.php', 'viewcache.php', 'sitemap.php', 'isearch.inc.php', 'google sitemap.php', 'stats.php', and 'auto spider img.php'. However, the validity of this issue has been disputed, with evidence suggesting that the $isearch path is set to a constant value, thus potentially mitigating the vulnerability.

Recommendations For iSearch version 2.16, consider restricting access to the isearch path parameter in the affected PHP files until a conclusive resolution is determined. As a temporary workaround, review the code to ensure $isearch path is indeed set to a constant value to prevent potential exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Related Identifiers

CVE-2006-5232

Affected Products

Isearch

References · 7

• 🔥 https://exploit-db.com/exploits/28772 · Exploit
• 🔥 http://securityfocus.com/bid/20401 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2006-5232 · Security Note
• http://securityfocus.com/archive/1/448099/100/0/threaded · Vendor Advisory
• http://securityfocus.com/archive/1/448225/100/100/threaded · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/29402 · Note
• http://securityfocus.com/archive/1/448006/100/0/threaded · Note