PT-2006-6221 · Wiclear · Wiclear

The Master · Published 2006-10-25 · Updated 2017-10-19 · CVE-2006-5506

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions WiClear version 0.10

Description The issue allows remote attackers to execute arbitrary PHP code via the path parameter in several files, including (1) inc/prepend.inc.php, (2) inc/lib/boxes.lib.php, (3) inc/lib/tools.lib.php, (4) tools/trackback/index.php, and (5) tools/utf8conversion/index.php in the admin/ directory; and (6) prepend.inc.php, (7) lib/boxes.lib.php, and (8) lib/history.lib.php in the inc/ directory.

Recommendations For WiClear version 0.10, consider restricting access to the vulnerable files until a patch is available. As a temporary workaround, avoid using the path parameter in the affected files. Restrict access to the admin/ and inc/ directories to minimize the risk of exploitation.

Exploit

Fix

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2006-5506

Affected Products

Wiclear

References · 15

• 🔥 https://exploit-db.com/exploits/2624 · Exploit
• http://secunia.com/advisories/22547 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2006-5506 · Security Note
• http://vupen.com/english/advisories/2006/4166 · Vendor Advisory
• http://osvdb.org/29948 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/29720 · Note
• http://osvdb.org/29942 · Note
• http://osvdb.org/29943 · Note
• http://osvdb.org/29946 · Note
• http://osvdb.org/29947 · Note
• http://wiclear.free.fr · Note
• http://osvdb.org/29944 · Note
• http://wiclear.free.fr/?Download · Note
• http://osvdb.org/29949 · Note
• http://osvdb.org/29945 · Note