Tagger LE Multiple PHP Code Injection Vulnerabilities

Bugtraq ID:	20023
Class:	Input Validation Error
CVE:	CVE-2006-4437
Remote:	Yes
Local:	No
Published:	Sep 14 2006 12:00AM
Updated:	Sep 19 2006 05:36PM
Credit:	Secunia Research discovered this issue.
Vulnerable:	Venture Nine Tagger LE 3
Not Vulnerable:

Tagger LE Multiple PHP Code Injection Vulnerabilities

Tagger LE is prone to multiple PHP code-injection vulnerabilities that may allow remote attackers to inject arbitrary PHP code into scripts.

If the attacker is successful, the attacker-supplied code will run in a PHP 'eval()' function call with the privileges of the server process.

A successful attack may result in unauthorized access in the context of the server.

Tagger LE Multiple PHP Code Injection Vulnerabilities

Attackers can exploit this issue via a web client.

Tagger LE Multiple PHP Code Injection Vulnerabilities

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected]:[email protected].

Tagger LE Multiple PHP Code Injection Vulnerabilities

References:

• Changes from 2.14.6 to 2.14.8 (MySource)
  
• MySource Classic Web Site (MySource)
  
• Secunia Advisory: Tagger LE PHP eval() Injection Vulnerabilities (Secunia)