CVE-2006-0325

Current Description

Etomite Content Management System 0.6, and possibly earlier versions, when downloaded from the web site in January 2006 after January 10, contains a back door in manager/includes/todo.inc.php, which allows remote attackers to execute arbitrary commands via the "cij" parameter.

Basic Data

PublishedJanuary 20, 2006
Last ModifiedOctober 19, 2018
Assignercve@mitre.org
Data TypeCVE
Data FormatMITRE
Data Version4.0
Problem TypeCWE-78
CVE Data Version4.0

Base Metric V2

CVSS 2 - Version2.0
CVSS 2 - Vector StringAV:N/AC:L/Au:N/C:P/I:P/A:P
CVSS 2 - Access VectorNETWORK
CVSS 2 - Access ComplexityLOW
CVSS 2 - AuthenticationNONE
CVSS 2 - Confidentiality ImpactPARTIAL
CVSS 2 - Availability ImpactPARTIAL
CVSS 2 - Base Score7.5
SeverityHIGH
Exploitability Score10.0
Impact Score6.4
Obtain All Privilegefalse
Obtain User Privilegetrue
Obtain Other Privilegefalse

Base Metric V3

No data provided.

Configurations

  • OR - Configuration 1
    Cpe VersionPartVendorProductVersionUpdateEditionLanguageSW EditionTarget SWTarget HWOtherVersion Start IncludingVersion End IncludingVersion Start ExcludingVersion End Excluding
    2.3ApplicationEtomiteEtomite********0.6

Vulnerable Software List

VendorProductVersions
Etomite Etomite *

References

NameSourceURLTags
18556http://secunia.com/advisories/18556SECUNIAPatch Vendor Advisory
http://www.etomite.org/forums/index.php?showtopic=4185http://www.etomite.org/forums/index.php?showtopic=4185CONFIRM
http://www.etomite.org/forums/index.php?showtopic=4291http://www.etomite.org/forums/index.php?showtopic=4291CONFIRM
http://www.lucaercoli.it/advs/etomite.txthttp://www.lucaercoli.it/advs/etomite.txtMISC
22693http://www.osvdb.org/22693OSVDB
20060127 Etomite CMS "Backdoored"http://www.securityfocus.com/archive/1/423497/100/0/threadedBUGTRAQ
20060130 Etomite followup informationhttp://www.securityfocus.com/archive/1/423523/100/0/threadedBUGTRAQ
16336http://www.securityfocus.com/bid/16336BID
ADV-2006-0283http://www.vupen.com/english/advisories/2006/0283VUPEN
etomite-default-backdoor(24254)https://exchange.xforce.ibmcloud.com/vulnerabilities/24254XF