comdev_csv_importer 代码执行漏洞

CVE编号

CVE-2006-5101

利用情况

暂无

补丁情况

N/A

披露时间

2006-10-03

漏洞描述

PHP remote file inclusion vulnerability in include.php in Comdev CSV Importer 3.1 and possibly 4.1, as used in (1) Comdev Contact Form 3.1, (2) Comdev Customer Helpdesk 3.1, (3) Comdev Events Calendar 3.1, (4) Comdev FAQ Support 3.1, (5) Comdev Guestbook 3.1, (6) Comdev Links Directory 3.1, (7) Comdev News Publisher 3.1, (8) Comdev Newsletter 3.1, (9) Comdev Photo Gallery 3.1, (10) Comdev Vote Caster 3.1, (11) Comdev Web Blogger 3.1, and (12) Comdev eCommerce 3.1, allows remote attackers to execute arbitrary PHP code via a URL in the path[docroot] parameter. NOTE: it has been reported that 4.1 versions might also be affected.

解决建议

建议您更新当前系统或软件至最新版，完成漏洞的修复。

参考链接
http://secunia.com/advisories/22133
http://secunia.com/advisories/22134
http://secunia.com/advisories/22135
http://secunia.com/advisories/22147
http://secunia.com/advisories/22149
http://secunia.com/advisories/22151
http://secunia.com/advisories/22153
http://secunia.com/advisories/22154
http://secunia.com/advisories/22157
http://secunia.com/advisories/22168
http://secunia.com/advisories/22169
http://secunia.com/advisories/22170
http://securityreason.com/securityalert/1658
http://www.osvdb.org/29299
http://www.osvdb.org/29300
http://www.osvdb.org/29301
http://www.osvdb.org/29302
http://www.osvdb.org/29303
http://www.osvdb.org/29304
http://www.osvdb.org/29305
http://www.osvdb.org/29306
http://www.osvdb.org/29307
http://www.osvdb.org/29308
http://www.osvdb.org/29309
http://www.osvdb.org/29310
http://www.osvdb.org/29311
http://www.securityfocus.com/archive/1/447184/100/0/threaded
http://www.securityfocus.com/archive/1/447185/100/0/threaded
http://www.securityfocus.com/archive/1/447186/100/0/threaded
http://www.securityfocus.com/archive/1/447187/100/0/threaded
http://www.securityfocus.com/archive/1/447188/100/0/threaded
http://www.securityfocus.com/archive/1/447190/100/0/threaded
http://www.securityfocus.com/archive/1/447192/100/0/threaded
http://www.securityfocus.com/archive/1/447193/100/0/threaded
http://www.securityfocus.com/archive/1/447194/100/0/threaded
http://www.securityfocus.com/archive/1/447201/100/0/threaded
http://www.securityfocus.com/archive/1/447207/100/0/threaded
http://www.securityfocus.com/archive/1/447209/100/0/threaded
http://www.securityfocus.com/archive/1/447213/100/0/threaded
http://www.vupen.com/english/advisories/2006/3803
http://www.vupen.com/english/advisories/2006/3804
http://www.vupen.com/english/advisories/2006/3805
http://www.vupen.com/english/advisories/2006/3806
http://www.vupen.com/english/advisories/2006/3807
http://www.vupen.com/english/advisories/2006/3808
http://www.vupen.com/english/advisories/2006/3809
http://www.vupen.com/english/advisories/2006/3810
http://www.vupen.com/english/advisories/2006/3811
http://www.vupen.com/english/advisories/2006/3812
http://www.vupen.com/english/advisories/2006/3813
http://www.vupen.com/english/advisories/2006/3814
http://www.vupen.com/english/advisories/2006/3815
https://exchange.xforce.ibmcloud.com/vulnerabilities/29220

受影响软件情况

#	类型	厂商	产品	版本	影响面
1
	运行在以下环境
	应用	comdev	comdev_csv_importer	3.1	-
	运行在以下环境
	应用	comdev	comdev_csv_importer	4.1	-

CVSS3评分 7.5

• 攻击路径 网络
• 攻击复杂度 低
• 权限要求 无
• 影响范围 N/A
• 用户交互 无
• 可用性 部分地
• 保密性 部分地
• 完整性 部分地

AV:N/AC:L/Au:N/C:P/I:P/A:P

CWE-ID	漏洞类型
CWE-94	对生成代码的控制不恰当（代码注入）

Exp相关链接

- avd.aliyun.com