CVE-2006-4635 Code injection in n/a
Remote authenticated superusers can inject arbitrary PHP code in MySource Classic, potentially leading to full system compromise.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2006-4635?
CVE-2006-4635 is a medium-severity code injection vulnerability in n/a, published on 8 Sep 2006. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
Unspecified vulnerability in MySource Classic 2.14.6, and possibly earlier, allows remote authenticated users, with superuser privileges, to inject arbitrary PHP code via unspecified vectors related to the Equation attribute in Web_Extensions - Notitia (I/II). NOTE: due to lack of details, it is not clear whether this issue is file inclusion, static code injection, or another type of issue.
Which versions are affected by CVE-2006-4635?
It affects 1 product.
Products include Squiz Mysource Classic.
How do I fix CVE-2006-4635?
No fix has been published for CVE-2006-4635 yet. Limit exposure of the affected software until one is available.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2006-4635 being exploited?
There is no known exploitation of CVE-2006-4635 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as GHSA-92x4-fq2c-9xx4.