PT-2006-6519 · Speedywiki · Speedywiki

Benjamin Mossé + 1 · Published 2006-11-10 · Updated 2024-02-14 · CVE-2006-5845

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Speedywiki version 2.0

Description The issue allows remote authenticated users to upload and execute arbitrary PHP code. This is achieved by setting the upload parameter to 1 in the index.php file.

Recommendations For Speedywiki version 2.0, consider restricting access to the index.php file to prevent unauthorized uploads until a patch is available. As a temporary workaround, disable the file upload functionality in index.php to minimize the risk of exploitation.

Fix

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2006-5845

Affected Products

Speedywiki

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2006-5845 · Security Note
• http://securitytracker.com/id?1017201 · Note
• http://secunia.com/advisories/22788 · Note
• http://vupen.com/english/advisories/2006/4421 · Note
• http://marc.info/?l=bugtraq&m=116302805802656&w=2 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/30131 · Note
• http://s-a-p.ca/index.php?page=OurAdvisories&id=9 · Note