Design/Logic Flaw

2006-05-1917:02:00

PRIOn knowledge base

www.prio-n.com

7.6 High

AI Score

Confidence

Low

0.012 Low

EPSS

Percentile

85.5%

JSON

The Update functionality in Bitrix Site Manager 4.1.x does not verify the authenticity of downloaded updates, which allows remote attackers to obtain sensitive information and ultimately execute arbitrary PHP code via DNS cache poisoning that redirects the user to a malicious site.

CPENameOperatorVersion
bitrix_site_managereq4.0.7
bitrix_site_managereq4.0.3
bitrix_site_managereq4.0.4
bitrix_site_managereq4.0.2
bitrix_site_managereq4.0.6
bitrix_site_managereq4.0.8
bitrix_site_managereq4.0.5
bitrix_site_managereq4.1.0
bitrix_site_managereq4.0.0

Name	Operator	Version
bitrix_site_manager	eq	4.0.7
bitrix_site_manager	eq	4.0.3
bitrix_site_manager	eq	4.0.4
bitrix_site_manager	eq	4.0.2
bitrix_site_manager	eq	4.0.6
bitrix_site_manager	eq	4.0.8
bitrix_site_manager	eq	4.0.5
bitrix_site_manager	eq	4.1.0
bitrix_site_manager	eq	4.0.0

References

securityreason.com/securityalert/918

securitytracker.com/id?1016121

www.securityfocus.com/archive/1/434367/100/0/threaded

www.vupen.com/english/advisories/2006/1858

exchange.xforce.ibmcloud.com/vulnerabilities/26542

exchange.xforce.ibmcloud.com/vulnerabilities/26548