PT-2006-7152 · Rad · Radupload

Arham · Published 2006-12-14 · Updated 2024-08-07 · CVE-2006-6549

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Rad Upload version 3.02

Description A remote file inclusion issue exists due to the handling of the save path parameter in the upload.php file. This could potentially allow remote attackers to execute arbitrary PHP code by providing a URL in the save path parameter. However, it's noted that the save path is initially defined as an empty string before use.

Recommendations For Rad Upload version 3.02, ensure that the save path parameter is properly validated and sanitized to prevent remote file inclusion attacks. Consider temporarily restricting access to the upload.php file until a proper fix can be applied. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2006-6549

Affected Products

Radupload

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2006-6549 · Security Note
• http://securityfocus.com/archive/1/454175/100/0/threaded · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/30864 · Note
• http://securityreason.com/securityalert/2034 · Note