PT-2006-6801 · Active Php · Active Php Bookmarks

Published 2006-11-29 · Updated 2024-08-07 · CVE-2006-6167

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Active PHP Bookmarks version 1.1.02

Description The issue allows remote attackers to execute arbitrary PHP code via a URL in the APB SETTINGS['apb path'] parameter in (1) apb common.php or (2) apb.php. However, it is noted that the PHP scripts exit if the attack vectors are present in GPC variables, which is disputed by some parties.

Recommendations For version 1.1.02, consider restricting access to the apb common.php and apb.php scripts to minimize the risk of exploitation. Additionally, avoid using the APB SETTINGS['apb path'] parameter in these scripts until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2006-6167

Affected Products

Active Php Bookmarks

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2006-6167 · Security Note
• http://securityfocus.com/archive/1/452559/100/0/threaded · Note
• http://securityfocus.com/bid/21263 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/30518 · Note
• http://securityfocus.com/bid/23670 · Note
• https://t.me/cvenotify/89825 · Telegram Post
• http://osvdb.org/31956 · Note
• http://securityfocus.com/archive/1/452490/100/0/threaded · Note