PT-2006-6121 · Php · Phpmybibli

Dedi Dwianto + 1 · Published 2006-10-18 · Updated 2017-07-20 · CVE-2006-5402

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions PHPmybibli versions 3.0.1 and earlier

Description The issue allows remote attackers to execute arbitrary PHP code via specific parameters in various PHP files. The vulnerable parameters include class path, javascript path, and include path in files such as cart.php, index.php, edit.php, and circ.php. Additionally, unspecified parameters in select.php and other files are also affected.

Recommendations For PHPmybibli versions 3.0.1 and earlier, consider restricting access to the vulnerable parameters class path, javascript path, and include path in the affected PHP files until a patch is available. As a temporary workaround, consider disabling the execution of remote files in the cart.php, index.php, edit.php, and circ.php files. Avoid using unspecified parameters in select.php and other files until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2006-5402

Affected Products

Phpmybibli

References · 10

• 🔥 http://securityfocus.com/bid/20578 · Exploit
• 🔥 https://exploit-db.com/exploits/2585 · Exploit
• 🔥 http://advisories.echo.or.id/adv/adv55-theday-2006.txt · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2006-5402 · Security Note
• http://vupen.com/english/advisories/2006/4064 · Vendor Advisory
• http://sigb.net/patch.php · Note
• http://attrition.org/pipermail/vim/2006-October/001088.html · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/29627 · Note
• http://marc.info/?l=bugtraq&m=116110988829381&w=2 · Note
• http://attrition.org/pipermail/vim/2006-October/001087.html · Note