CVE-2006-0722 - settings.php in Reamday Enterprises Magic Downloads 1.1.3, when register_globals is enabled, allows

CVE-2006-0722

Summary

settings.php in Reamday Enterprises Magic Downloads 1.1.3, when register_globals is enabled, allows remote attackers to modify program behavior, potentially bypassing authentication controls, via modified (1) action, (2) passwd, (3) admin_password, (4) new_passwd, and (5) confirm_passwd variables, which are not initialized.

References

Vulnerable Configurations

cpe:2.3:a:reamday_enterprises:magic_downloads:1.1.3:*:*:*:*:*:*:*
cpe:2.3:a:reamday_enterprises:magic_downloads:1.1.3:*:*:*:*:*:*:*

CVSS

Base:	2.6 (as of 19-10-2018 - 15:45)
Impact:
Exploitability:

CWE

NVD-CWE-Other

CAPEC

Access

Vector	Complexity	Authentication
NETWORK	HIGH	NONE

Impact

Confidentiality	Integrity	Availability
NONE	PARTIAL	NONE

cvss-vector via4

AV:N/AC:H/Au:N/C:N/I:P/A:N

refmap via4

bid	16665
bugtraq	20060221 [eVuln] Magic Downloads Unauthorized Data Modification
misc	http://evuln.com/vulns/73/summary.html
secunia	18877
sreason	468
vupen	ADV-2006-0602
xf	magicdownloads-settings-access(24615)

Last major update

19-10-2018 - 15:45

Published

16-02-2006 - 11:02

Last modified

19-10-2018 - 15:45