CVE-2006-1105

Pixelpost 1.5 beta 1 and earlier allows remote attackers to obtain configuration information via a direct request to includes/phpinfo.php, which calls the phpinfo function. NOTE: the vendor has disputed some issues from the original disclosure, but due to the vagueness of the dispute, it is not clear whether the vendor is disputing this particular issue.

CVSS v2.0 5.0 MEDIUM

5.0^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:L/Au:N/C:P/I:N/A:N

Exploitability : 10.0 / Impact : 2.9

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact NONE

References

Link	Resource
http://forum.pixelpost.org/showthread.php?t=3535	Exploit
http://www.neosecurityteam.net/index.php?action=advisories&id=19	Exploit Vendor Advisory
http://www.securityfocus.com/archive/1/426764/100/0/threaded
http://www.securityfocus.com/bid/16964	Exploit
http://www.vupen.com/english/advisories/2006/0823
https://exchange.xforce.ibmcloud.com/vulnerabilities/25048

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:pixelpost:pixelpost:1.4.3:::::::*
	cpe:2.3:a:pixelpost:pixelpost:1.5_beta1:::::::*

History

No history.

Information

Published : 2006-03-09 13:06

Updated : 2023-12-10 10:28

NVD link : CVE-2006-1105

Mitre link : CVE-2006-1105

CVE.ORG link : CVE-2006-1105

JSON object : View

Products Affected

pixelpost

pixelpost

CWE

NVD-CWE-Other

{"id": "CVE-2006-1105", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 5.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}]}, "published": "2006-03-09T13:06:00.000", "references": [{"url": "http://forum.pixelpost.org/showthread.php?t=3535", "tags": ["Exploit"], "source": "cve@mitre.org"}, {"url": "http://www.neosecurityteam.net/index.php?action=advisories&id=19", "tags": ["Exploit", "Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "http://www.securityfocus.com/archive/1/426764/100/0/threaded", "source": "cve@mitre.org"}, {"url": "http://www.securityfocus.com/bid/16964", "tags": ["Exploit"], "source": "cve@mitre.org"}, {"url": "http://www.vupen.com/english/advisories/2006/0823", "source": "cve@mitre.org"}, {"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/25048", "source": "cve@mitre.org"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-Other"}]}], "descriptions": [{"lang": "en", "value": "Pixelpost 1.5 beta 1 and earlier allows remote attackers to obtain configuration information via a direct request to includes/phpinfo.php, which calls the phpinfo function. NOTE: the vendor has disputed some issues from the original disclosure, but due to the vagueness of the dispute, it is not clear whether the vendor is disputing this particular issue."}], "lastModified": "2018-10-18T16:30:45.790", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:pixelpost:pixelpost:1.4.3:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "49737B14-809D-4700-AF4C-7712D02EE391"}, {"criteria": "cpe:2.3:a:pixelpost:pixelpost:1.5_beta1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D7C7C61B-362D-4784-BACB-32FBACF20C73"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org", "evaluatorSolution": "This vulnerability may affect all versions of Pixelpost."}