PT-2006-6897 · Neocrome · Neocrome Land Down Under

Mustafa Can Bjorn Ipekci + 1 · Published 2006-12-04 · Updated 2018-10-17 · CVE-2006-6268

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Neocrome Land Down Under (LDU) versions 8.x and earlier

Description The issue allows remote authenticated users to execute arbitrary SQL commands. This is achieved via a url-encoded id parameter to the "users.php" endpoint that begins with a valid filename. An example of such an exploit includes using "default.gif" followed by a double-encoded NULL and ' (apostrophe) (%2500%2527).

Recommendations For Neocrome Land Down Under (LDU) versions 8.x and earlier, consider restricting access to the users.php endpoint to minimize the risk of exploitation. Avoid using the id parameter in the affected endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Related Identifiers

CVE-2006-6268

Affected Products

Neocrome Land Down Under

References · 5

• 🔥 http://nukedx.com/?viewdoc=51 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2006-6268 · Security Note
• http://securityfocus.com/bid/21227 · Note
• http://securityfocus.com/archive/1/452259/100/100/threaded · Note
• http://securityreason.com/securityalert/1954 · Note