Published: 12/07/2006 Updated: 18/10/2018

CVSS v2 Base Score: 7.5 | Impact Score: 6.4 | Exploitability Score: 10

VMScore: 755

Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P

includes/editor/insert_image.php in Pivot 1.30 RC2 and previous versions creates the authentication credentials from parameters, which allows remote malicious users to obtain privileges and upload arbitrary files via modified (1) pass and (2) session parameters, and (3) pass and (4) userlevel indices of the (a) Pivot_Vars[] or (b) Users[] array parameters.

Vulnerable Product	Search on Vulmon	Subscribe to Product
pivot pivot

#!/usr/bin/php -q -d short_open_tag=on <? echo "Pivot <= 130 RC2 privileges escalation / remote commands execution exploit\n"; echo "by rgod rgod@autisticiorg\n"; echo "site: retrogodaltervistaorg\n"; echo "dorks: \"Powered byPivot\"\n"; echo "version specific: \"Powered byPivot - 130 RC2\" +Rippersnapper\n\n"; /* works with regis ...

NVD-CWE-Other http://retrogod.altervista.org/pivot_130RC2_xpl.html http://www.securityfocus.com/bid/18881 http://secunia.com/advisories/20962 http://www.osvdb.org/27126 http://securityreason.com/securityalert/1214 http://www.vupen.com/english/advisories/2006/2744 https://exchange.xforce.ibmcloud.com/vulnerabilities/27671 http://www.securityfocus.com/archive/1/439495/100/0/threaded https://nvd.nist.gov https://www.exploit-db.com/exploits/1991/

Get Started

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Twitter Reddit Linkedin Facebook

CVE-2006-3531

Vulnerability Summary

Exploits

References

Vulmon Search

About

Products

Connect