PT-2006-6566 · @Cid · @Cid Stats

Published 2006-11-15 · Updated 2024-08-07 · CVE-2006-5899

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions @cid stats version 2.3

Description A remote file inclusion issue in install.php3 allows remote attackers to execute arbitrary PHP code via a URL in the repertoire parameter. Note that this issue has been disputed by a third party, who claims that install.php3 is intended to be deleted after installation and, if not deleted, intentionally allows setting repertoire without an inclusion attack.

Recommendations For @cid stats version 2.3, ensure that install.php3 is deleted after installation to prevent potential exploitation. As a temporary workaround, consider restricting access to install.php3 to minimize the risk of exploitation. Avoid using the repertoire parameter in the affected install.php3 file until the issue is resolved.

Exploit

Fix

Related Identifiers

CVE-2006-5899

Affected Products

@Cid Stats

References · 4

• 🔥 https://exploit-db.com/exploits/28913 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2006-5899 · Security Note
• http://securityfocus.com/archive/1/450685/100/0/threaded · Note
• http://securityfocus.com/archive/1/450676/100/0/threaded · Note