PT-2006-6444 · Unknown · Free File Hosting+1

Steven M. Christey · Published 2006-11-06 · Updated 2018-10-17 · CVE-2006-5763

Positive Technologies (AI Summary)

CVSS v2.0

5.1

Medium

Base vector

AV:N/AC:H/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions: Free File Hosting versions 1.1 and earlier Free Image Hosting version 2.0

Description: The issue allows remote attackers to execute arbitrary PHP code via a URL in the AD BODY TEMP parameter to specific API endpoints, including "/login.php", "/register.php", or "/send.php", when register globals is enabled. This affects Free File Hosting and also Free Image Hosting due to shared code.

Recommendations: For Free File Hosting versions 1.1 and earlier, consider disabling the register globals setting to mitigate the risk of exploitation. For Free Image Hosting version 2.0, restrict access to the affected API endpoints until a fix is applied. As a temporary workaround, avoid using the AD BODY TEMP parameter in the affected API endpoints until the issue is resolved.

Exploit

Fix

Related Identifiers

CVE-2006-5763

Affected Products

Free File Hosting

Free Image Hosting

References · 13

• 🔥 https://exploit-db.com/exploits/3568 · Exploit
• 🔥 https://exploit-db.com/exploits/29773 · Exploit
• 🔥 https://exploit-db.com/exploits/29774 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2006-5763 · Security Note
• http://secunia.com/advisories/22594 · Vendor Advisory
• http://osvdb.org/30145 · Note
• http://osvdb.org/30144 · Note
• http://osvdb.org/30146 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/33196 · Note
• http://securityfocus.com/archive/1/463707/100/0/threaded · Note
• http://attrition.org/pipermail/vim/2007-March/001473.html · Note
• http://securityfocus.com/bid/23118 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/29874 · Note