CVE-2006-3531 includes/editor/insert_image.php in Pivot 1.30 RC2 and earlier creates the authentication credentials from parameters, which allows remote attackers to obtain privileges and upload arbitrary files via...
HighCVSS 7.5
EPSS 9.5%
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
includes/editor/insert_image.php in Pivot 1.30 RC2 and earlier creates the authentication credentials from parameters, which allows remote attackers to obtain privileges and upload arbitrary files via modified (1) pass and (2) session parameters, and (3) pass and (4) userlevel indices of the (a) Pivot_Vars[] or (b) Users[] array parameters.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| pivot | <= 1.30_rc2 | No fix listed |
References
- retrogod.altervista.org exploit
- 20962 third-party-advisory vendor-advisory
- 1214 third-party-advisory
- 27126 vdb-entry
- 20060707 Pivot <=1.30rc2 privilege escalation / remote commands execution mailing-list
- 18881 exploit vdb-entry
- ADV-2006-2744 vdb-entry
- pivot-insertimage-file-upload(27671) vdb-entry