PT-2007-1285 · Robin De Graff · Robin De Graff Somery

Spc-X · Published 2007-02-12 · Updated 2024-08-07 · CVE-2006-7006

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Robin de Graff Somery version 0.4.4

Description A remote file inclusion issue in upload/admin/team.php allows remote attackers to potentially execute arbitrary PHP code via a URL in the checkauth parameter. However, it's noted that the checkauth parameter is only used in conditionals, which might affect the exploitability of this issue.

Recommendations For version 0.4.4, consider restricting access to the upload/admin/team.php file until a patch is available, and avoid using the checkauth parameter in this context to minimize potential risks.

Exploit

Fix

Related Identifiers

CVE-2006-7006

Affected Products

Robin De Graff Somery

References · 7

• 🔥 http://root-security.org/danger/Somery.txt · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2006-7006 · Security Note
• http://packetstorm.linuxsecurity.com/0606-exploits/Somery.txt · Note
• http://attrition.org/pipermail/vim/2007-February/001305.html · Note
• http://securityfocus.com/bid/18412 · Note
• http://osvdb.org/27662 · Note
• http://archives.neohapsis.com/archives/bugtraq/2006-06/0242.html · Note