CVE-2005-3926

Опубликовано: 30 нояб. 2005

Источник: nvd

CVSS2: 7.5

EPSS Низкий

Описание

Direct static code injection vulnerability in error.php in GuppY 4.5.9 and earlier, when register_globals is disabled, allows remote attackers to execute arbitrary PHP code via the _SERVER[REMOTE_ADDR] parameter, which is injected into a .inc script that is later included by the main script.

Ссылки

http://rgod.altervista.org/guppy459_xpl.html
Exploit
Vendor Advisory
http://secunia.com/advisories/17790
Vendor Advisory
http://securitytracker.com/id?1015279
Exploit
http://www.securityfocus.com/archive/1/417899/100/0/threaded
http://www.securityfocus.com/bid/15609
Exploit
http://www.vupen.com/english/advisories/2005/2635
https://exchange.xforce.ibmcloud.com/vulnerabilities/23318
http://rgod.altervista.org/guppy459_xpl.html
Exploit
Vendor Advisory
http://secunia.com/advisories/17790
Vendor Advisory
http://securitytracker.com/id?1015279
Exploit
http://www.securityfocus.com/archive/1/417899/100/0/threaded
http://www.securityfocus.com/bid/15609
Exploit
http://www.vupen.com/english/advisories/2005/2635
https://exchange.xforce.ibmcloud.com/vulnerabilities/23318

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:guppy:guppy:4.5:*:*:*:*:*:*:*

cpe:2.3:a:guppy:guppy:4.5.3:*:*:*:*:*:*:*

cpe:2.3:a:guppy:guppy:4.5.3a:*:*:*:*:*:*:*

cpe:2.3:a:guppy:guppy:4.5.4:*:*:*:*:*:*:*

cpe:2.3:a:guppy:guppy:4.5.9:*:*:*:*:*:*:*

EPSS

Процентиль: 90%

0.05605

Низкий

7.5 High

CVSS2

Дефекты

NVD-CWE-Other

Связанные уязвимости

GHSA-hw72-fhc8-8qf4

github

почти 4 года назад