PT-2006-7115 · Dada · Dadaimc

Published 2006-12-14 · Updated 2017-07-29 · CVE-2006-6511

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions dadaIMC version .99.3

Description The issue arises from an insufficiently restrictive FilesMatch directive in the installed .htaccess file. This allows remote attackers to execute arbitrary PHP code by uploading files with specific names, including those containing feature, editor, newswire, otherpress, admin, pbook, media, or mod. These file names are processed as PHP file types, leading to potential code execution.

Recommendations For dadaIMC version .99.3, consider updating the .htaccess file to include more restrictive FilesMatch directives to prevent the execution of arbitrary PHP code from uploaded files. As a temporary workaround, restrict access to file uploads or limit the types of files that can be uploaded to prevent potential exploitation.

Fix

Related Identifiers

CVE-2006-6511

Affected Products

Dadaimc

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2006-6511 · Security Note
• http://secunia.com/advisories/23305 · Vendor Advisory
• http://vupen.com/english/advisories/2006/4977 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/30862 · Note
• http://bugs.dadaimc.org/view.php?id=191 · Note