PT-2007-1450 · Php · Php-Stats

Rgod · Published 2007-03-20 · Updated 2017-10-19 · CVE-2006-7172

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions PHP-Stats versions 0.1.9.1b and earlier

Description The issue allows remote attackers to execute arbitrary code via SQL injection vulnerabilities. This can be achieved by providing a leading dotted-quad IP address string in either the PC-REMOTE-ADDR HTTP header, which is inserted into $ SERVER['HTTP PC REMOTE ADDR'], or the ip parameter.

Recommendations For PHP-Stats versions 0.1.9.1b and earlier, consider disabling the php-stats.recphp.php script until a patch is available to prevent exploitation of the SQL injection vulnerabilities. Restrict access to the ip parameter in the affected script to minimize the risk of exploitation. Avoid using the PC-REMOTE-ADDR HTTP header with untrusted input until the issue is resolved.

Exploit

Fix

Related Identifiers

CVE-2006-7172

Affected Products

Php-Stats

References · 7

• 🔥 https://exploit-db.com/exploits/3497 · Exploit
• 🔥 https://exploit-db.com/exploits/3496 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2006-7172 · Security Note
• http://secunia.com/advisories/24553 · Vendor Advisory
• http://vupen.com/english/advisories/2007/1004 · Note
• http://osvdb.org/34280 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/33031 · Note