PT-2006-6578 · Campware · Campware Campsite

Published 2006-11-15 · Updated 2008-09-05 · CVE-2006-5911

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Campware Campsite versions prior to 2.6.2

Description The issue allows remote attackers to execute arbitrary PHP code via a URL in the g documentRoot parameter to multiple PHP files, including Alias.php, Article.php, and others in the implementation/management/classes/ directory, as well as configuration.php and db connect.php in the implementation/management/ directory, and LocalizerConfig.php and LocalizerLanguage.php in the implementation/management/priv/localizer/ directory.

Recommendations For Campware Campsite versions prior to 2.6.2, update to version 2.6.2 or later to resolve the issue. As a temporary workaround, consider restricting access to the vulnerable PHP files until a patch is available. Avoid using the g documentRoot parameter in the affected API endpoints until the issue is resolved.

Exploit

Fix

Related Identifiers

CVE-2006-5911

Affected Products

Campware Campsite

References · 85

• 🔥 https://exploit-db.com/exploits/30006 · Exploit
• 🔥 https://exploit-db.com/exploits/29967 · Exploit
• 🔥 https://exploit-db.com/exploits/30003 · Exploit
• 🔥 https://exploit-db.com/exploits/29985 · Exploit
• 🔥 https://exploit-db.com/exploits/29994 · Exploit
• 🔥 https://exploit-db.com/exploits/29982 · Exploit
• 🔥 https://exploit-db.com/exploits/29972 · Exploit
• 🔥 https://exploit-db.com/exploits/29990 · Exploit
• 🔥 https://exploit-db.com/exploits/29984 · Exploit
• 🔥 https://exploit-db.com/exploits/29966 · Exploit
• 🔥 https://exploit-db.com/exploits/29981 · Exploit
• 🔥 https://exploit-db.com/exploits/29968 · Exploit
• 🔥 https://exploit-db.com/exploits/29983 · Exploit
• 🔥 https://exploit-db.com/exploits/29976 · Exploit
• 🔥 https://exploit-db.com/exploits/29996 · Exploit