PT-2007-1273 · Ozzywork · Ozzywork Gallery

Dj Remix · Published 2007-02-12 · Updated 2024-01-26 · CVE-2006-6994

Positive Technologies (AI Summary)

CVSS v2.0

6.4

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:P/A:P

Name of the Vulnerable Software and Affected Versions OzzyWork Gallery versions 2.0 and earlier

Description The issue concerns an unrestricted file upload vulnerability. This allows remote attackers to upload and execute arbitrary ASP files by bypassing client-side security checks.

Recommendations For OzzyWork Gallery versions 2.0 and earlier, consider disabling the file upload functionality in add.asp until a patch is available to prevent the upload and execution of arbitrary ASP files. Restrict access to the add.asp module to minimize the risk of exploitation.

Fix

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2006-6994

Affected Products

Ozzywork Gallery

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2006-6994 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/26365 · Note
• http://vupen.com/english/advisories/2006/1768 · Note
• http://osvdb.org/25427 · Note
• http://securityfocus.com/bid/17946 · Note
• http://secunia.com/advisories/20049 · Note
• http://marc.info/?l=bugtraq&m=114723238307299&w=2 · Note