PT-2007-1326 · Shoutpro · Shoutpro

Steven M. Christey · Published 2007-02-24 · Updated 2018-10-16 · CVE-2006-7047

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Shoutpro version 1.0

Description The issue allows remote attackers to bypass IP ban restrictions. This is achieved by providing a URL in the path parameter that points to an alternate bannedips.php file. It was initially reported as a potential remote file inclusion issue, but further analysis indicates it cannot be used for code execution.

Recommendations For Shoutpro version 1.0, consider restricting access to the include.php file to prevent bypassing IP ban restrictions until a fix is available. As a temporary workaround, restrict the use of the path parameter to minimize the risk of exploitation.

Fix

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2006-7047

Affected Products

Shoutpro

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2006-7047 · Security Note
• http://securityfocus.com/archive/1/436997/30/4410/threaded · Note
• http://securityfocus.com/archive/1/436975/30/4440/threaded · Note
• http://securityreason.com/securityalert/2303 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/27111 · Note