Lucene search

[email protected]CVE-2006-2331

HistoryMay 12, 2006 - 12:02 a.m.

CVE-2006-2331

2006-05-1200:02:00

[email protected]

web.nvd.nist.gov

cve-2006-2331

php-fusion

directory traversal

vulnerabilities

remote code execution

security advisory

6.4 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:P/A:N

7.4 High

AI Score

Confidence

Low

0.006 Low

EPSS

Percentile

79.1%

JSON

Multiple directory traversal vulnerabilities in PHP-Fusion 6.00.306 allow remote attackers to include and execute arbitrary local files via (1) a … (dot dot) in the settings[locale] parameter in infusions/last_seen_users_panel/last_seen_users_panel.php, and (2) a … (dot dot) in the localeset parameter in setup.php. NOTE: the vendor states that this issue might exist due to problems in third party local files.

Affected configurations

NVD

Node

php_fusionphp_fusionMatch6.00.3

php_fusionphp_fusionMatch6.00.105

php_fusionphp_fusionMatch6.00.106

php_fusionphp_fusionMatch6.00.107

php_fusionphp_fusionMatch6.00.109

php_fusionphp_fusionMatch6.00.110

php_fusionphp_fusionMatch6.00.204

php_fusionphp_fusionMatch6.00.206

php_fusionphp_fusionMatch6.00.303

php_fusionphp_fusionMatch6.00.304

php_fusionphp_fusionMatch6.00.306

CPENameOperatorVersion
php_fusion:php_fusionphp fusioneq6.00.3
php_fusion:php_fusionphp fusioneq6.00.105
php_fusion:php_fusionphp fusioneq6.00.106
php_fusion:php_fusionphp fusioneq6.00.107
php_fusion:php_fusionphp fusioneq6.00.109
php_fusion:php_fusionphp fusioneq6.00.110
php_fusion:php_fusionphp fusioneq6.00.204
php_fusion:php_fusionphp fusioneq6.00.206
php_fusion:php_fusionphp fusioneq6.00.303
php_fusion:php_fusionphp fusioneq6.00.304

CPE	Name	Operator	Version
php_fusion:php_fusion	php fusion	eq	6.00.3
php_fusion:php_fusion	php fusion	eq	6.00.105
php_fusion:php_fusion	php fusion	eq	6.00.106
php_fusion:php_fusion	php fusion	eq	6.00.107
php_fusion:php_fusion	php fusion	eq	6.00.109
php_fusion:php_fusion	php fusion	eq	6.00.110
php_fusion:php_fusion	php fusion	eq	6.00.204
php_fusion:php_fusion	php fusion	eq	6.00.206
php_fusion:php_fusion	php fusion	eq	6.00.303
php_fusion:php_fusion	php fusion	eq	6.00.304

Rows per page:

1-10 of 111

References

secunia.com/advisories/19992

securityreason.com/securityalert/194

securityreason.com/securityalert/873

www.osvdb.org/25538

www.osvdb.org/25539

www.php-fusion.co.uk/news.php

www.php-fusion.co.uk/news.php?readmore=321

www.securityfocus.com/archive/1/433277/100/0/threaded

www.securityfocus.com/bid/17898

www.vupen.com/english/advisories/2006/1735

exchange.xforce.ibmcloud.com/vulnerabilities/26389

6.4 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:P/A:N

7.4 High

AI Score

Confidence

Low

0.006 Low

EPSS

Percentile

79.1%

JSON

Related for CVE-2006-2331

nvd1 cvelist1 prion1