CVE-2006-1105

Pixelpost 1.5 beta 1 and earlier allows remote attackers to obtain configuration information via a direct request to includes/phpinfo.php, which calls the phpinfo function. NOTE: the vendor has disputed some issues from the original disclosure, but due to the vagueness of the dispute, it is not clear whether the vendor is disputing this particular issue.

CVSS v2.0 5.0 MEDIUM

5.0^/10

CVSS v2.0 : MEDIUM

V2 Legend

Vector : AV:N/AC:L/Au:N/C:P/I:N/A:N

Exploitability : 10.0 / Impact : 2.9

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact NONE

References

Link	Resource
http://www.neosecurityteam.net/index.php?action=advisories&id=19	Exploit Vendor Advisory
http://forum.pixelpost.org/showthread.php?t=3535	Exploit
http://www.securityfocus.com/bid/16964	Exploit
http://www.vupen.com/english/advisories/2006/0823
https://exchange.xforce.ibmcloud.com/vulnerabilities/25048
http://www.securityfocus.com/archive/1/426764/100/0/threaded

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:pixelpost:pixelpost:1.4.3:::::::*
	cpe:2.3:a:pixelpost:pixelpost:1.5_beta1:::::::*

Information

Published : 2006-03-09 05:06

Updated : 2018-10-18 09:30

NVD link : CVE-2006-1105

Mitre link : CVE-2006-1105

JSON object : View

CWE

NVD-CWE-Other

Products Affected

pixelpost

pixelpost

{"cve": {"data_type": "CVE", "references": {"reference_data": [{"url": "http://www.neosecurityteam.net/index.php?action=advisories&id=19", "name": "http://www.neosecurityteam.net/index.php?action=advisories&id=19", "tags": ["Exploit", "Vendor Advisory"], "refsource": "MISC"}, {"url": "http://forum.pixelpost.org/showthread.php?t=3535", "name": "http://forum.pixelpost.org/showthread.php?t=3535", "tags": ["Exploit"], "refsource": "MISC"}, {"url": "http://www.securityfocus.com/bid/16964", "name": "16964", "tags": ["Exploit"], "refsource": "BID"}, {"url": "http://www.vupen.com/english/advisories/2006/0823", "name": "ADV-2006-0823", "tags": [], "refsource": "VUPEN"}, {"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/25048", "name": "pixelpost-phpinfo-obtain-information(25048)", "tags": [], "refsource": "XF"}, {"url": "http://www.securityfocus.com/archive/1/426764/100/0/threaded", "name": "20060304 Pixel Post Multiple Vulnerabilities", "tags": [], "refsource": "BUGTRAQ"}]}, "data_format": "MITRE", "description": {"description_data": [{"lang": "en", "value": "Pixelpost 1.5 beta 1 and earlier allows remote attackers to obtain configuration information via a direct request to includes/phpinfo.php, which calls the phpinfo function. NOTE: the vendor has disputed some issues from the original disclosure, but due to the vagueness of the dispute, it is not clear whether the vendor is disputing this particular issue."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "en", "value": "NVD-CWE-Other"}]}]}, "data_version": "4.0", "CVE_data_meta": {"ID": "CVE-2006-1105", "ASSIGNER": "cve@mitre.org"}}, "impact": {"baseMetricV2": {"cvssV2": {"version": "2.0", "baseScore": 5.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "severity": "MEDIUM", "impactScore": 2.9, "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}}, "publishedDate": "2006-03-09T13:06Z", "configurations": {"nodes": [{"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:a:pixelpost:pixelpost:1.4.3:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:pixelpost:pixelpost:1.5_beta1:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}]}], "CVE_data_version": "4.0"}, "lastModifiedDate": "2018-10-18T16:30Z"}

5.0 /10