PT-2006-6563 · Remlab · Remlab Web Mech Designer

Jesper Jurcenoks · Published 2006-11-27 · Updated 2018-10-17 · CVE-2006-5896

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions REMLAB Web Mech Designer version 2.0.5

Description The issue allows remote attackers to obtain the full path of the script by providing an incorrect Tonnage parameter to the "calculate.php" endpoint, triggering a divide-by-zero error. This error leaks the path in an error message.

Recommendations For version 2.0.5, as a temporary workaround, consider restricting access to the "calculate.php" endpoint until a patch is available. Avoid using the Tonnage parameter in a way that could trigger a divide-by-zero error until the issue is resolved.

Exploit

Fix

Related Identifiers

CVE-2006-5896

Affected Products

Remlab Web Mech Designer

References · 7

• 🔥 http://lists.grok.org.uk/pipermail/full-disclosure/2006-November/050879.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2006-5896 · Security Note
• http://securityreason.com/securityalert/1911 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/30538 · Note
• http://netvigilance.com/advisory0007 · Note
• http://osvdb.org/30264 · Note
• http://securityfocus.com/archive/1/453020/100/0/threaded · Note