PT-2006-6111 · Opendock · Opendock Fullcore

Matdhule · Published 2006-10-18 · Updated 2017-10-19 · CVE-2006-5392

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions OpenDock FullCore versions 4.4 and earlier

Description The issue allows remote attackers to execute arbitrary PHP code via a URL in the doc directory parameter in various PHP scripts, including (1) sw/index sw.php, (2) cart.php, (3) lib cart.php, (4) lib read cart.php, (5) lib sys cart.php, and (6) txt info cart.php in sw/lib cart/, (7) comment.php, (8) find comment.php, and (9) lib comment.php in sw/lib comment/, and (10) sw/lib find/find.php.

Recommendations For OpenDock FullCore versions 4.4 and earlier, consider disabling the doc directory parameter in the affected PHP scripts until a patch is available. Restrict access to the vulnerable PHP scripts to minimize the risk of exploitation. Avoid using the doc directory parameter in the affected API endpoints until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Related Identifiers

CVE-2006-5392

Affected Products

Opendock Fullcore

References · 16

• 🔥 https://exploit-db.com/exploits/2570 · Exploit
• 🔥 http://securityfocus.com/bid/20573 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2006-5392 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/29578 · Note
• http://vupen.com/english/advisories/2006/4052 · Note
• http://osvdb.org/29914 · Note
• http://osvdb.org/29907 · Note
• http://osvdb.org/29909 · Note
• http://secunia.com/advisories/22410 · Note
• http://osvdb.org/29912 · Note
• http://osvdb.org/29915 · Note
• http://osvdb.org/29910 · Note
• http://osvdb.org/29913 · Note
• http://osvdb.org/29911 · Note
• http://osvdb.org/29906 · Note