PT-2006-6690 · Webshare · Oliver

Published 2006-11-22 · Updated 2017-07-20 · CVE-2006-6043

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Oliver (formerly Webshare) versions 1.2.2 and earlier

Description The issue allows remote attackers to execute arbitrary PHP code when register globals is enabled. This is achieved via a UNC share pathname or a local file pathname in the conf[motdfile] parameter, which is accessed by the file exists function.

Recommendations For Oliver (formerly Webshare) versions 1.2.2 and earlier, consider disabling the register globals setting to prevent exploitation. Additionally, restrict access to the conf[motdfile] parameter to minimize the risk of arbitrary PHP code execution. Avoid using the conf[motdfile] parameter with untrusted input until the issue is resolved.

Fix

Related Identifiers

CVE-2006-6043

Affected Products

Oliver

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2006-6043 · Security Note
• http://secunia.com/advisories/23031 · Vendor Advisory
• http://securityfocus.com/bid/21202/info · Note
• http://vupen.com/english/advisories/2006/4608 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/30415 · Note