PT-2006-7369 · Php · Php Live!

Doz · Published 2006-12-27 · Updated 2018-10-17 · CVE-2006-6769

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions: PHP Live! versions 3.2.2 and earlier

Description: The issue allows remote attackers to inject arbitrary web script or HTML, potentially leading to security breaches. This is achieved through several parameters in different PHP files, including the search string parameter in "setup/transcripts.php", the l parameter in "index.php", the login field in "phplive/index.php", and the deptid and x parameters in "phplive/message box.php".

Recommendations: For PHP Live! versions 3.2.2 and earlier, consider disabling the vulnerable parameters search string, l, login, deptid, and x in their respective files until a patch is available. Restrict access to the affected PHP files to minimize the risk of exploitation. Avoid using the parameters search string, l, login, deptid, and x in the affected API endpoints until the issue is resolved.

Exploit

Fix

Related Identifiers

CVE-2006-6769

Affected Products

Php Live!

References · 7

• 🔥 http://hackerscenter.com/archive/view.asp?id=26833 · Exploit
• 🔥 http://securityfocus.com/bid/21737 · Exploit
• http://secunia.com/advisories/23488 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2006-6769 · Security Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-6769 · Note
• http://securityfocus.com/archive/1/455269/100/0/threaded · Note
• http://securityreason.com/securityalert/2068 · Note