Lucene search

[email protected]CVE-2006-2331

HistoryMay 12, 2006 - 12:02 a.m.

CVE-2006-2331

2006-05-1200:02:00

[email protected]

web.nvd.nist.gov

cve-2006-2331

php-fusion

directory traversal

vulnerabilities

remote code execution

security advisory

CVSS2

6.4

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:P/A:N

AI Score

7.4

Confidence

Low

EPSS

0.006

Percentile

79.1%

JSON

Multiple directory traversal vulnerabilities in PHP-Fusion 6.00.306 allow remote attackers to include and execute arbitrary local files via (1) a … (dot dot) in the settings[locale] parameter in infusions/last_seen_users_panel/last_seen_users_panel.php, and (2) a … (dot dot) in the localeset parameter in setup.php. NOTE: the vendor states that this issue might exist due to problems in third party local files.

Affected configurations

NVD

Node

php_fusionphp_fusionMatch6.00.3

php_fusionphp_fusionMatch6.00.105

php_fusionphp_fusionMatch6.00.106

php_fusionphp_fusionMatch6.00.107

php_fusionphp_fusionMatch6.00.109

php_fusionphp_fusionMatch6.00.110

php_fusionphp_fusionMatch6.00.204

php_fusionphp_fusionMatch6.00.206

php_fusionphp_fusionMatch6.00.303

php_fusionphp_fusionMatch6.00.304

php_fusionphp_fusionMatch6.00.306

VendorProductVersionCPE
php_fusionphp_fusion6.00.3cpe:/a:php_fusion:php_fusion:6.00.3:::
php_fusionphp_fusion6.00.109cpe:/a:php_fusion:php_fusion:6.00.109:::
php_fusionphp_fusion6.00.105cpe:/a:php_fusion:php_fusion:6.00.105:::
php_fusionphp_fusion6.00.206cpe:/a:php_fusion:php_fusion:6.00.206:::
php_fusionphp_fusion6.00.110cpe:/a:php_fusion:php_fusion:6.00.110:::
php_fusionphp_fusion6.00.306cpe:/a:php_fusion:php_fusion:6.00.306:::
php_fusionphp_fusion6.00.204cpe:/a:php_fusion:php_fusion:6.00.204:::
php_fusionphp_fusion6.00.106cpe:/a:php_fusion:php_fusion:6.00.106:::
php_fusionphp_fusion6.00.303cpe:/a:php_fusion:php_fusion:6.00.303:::
php_fusionphp_fusion6.00.107cpe:/a:php_fusion:php_fusion:6.00.107:::

Vendor	Product	Version	CPE
php_fusion	php_fusion	6.00.3	cpe:/a:php_fusion:php_fusion:6.00.3:::
php_fusion	php_fusion	6.00.109	cpe:/a:php_fusion:php_fusion:6.00.109:::
php_fusion	php_fusion	6.00.105	cpe:/a:php_fusion:php_fusion:6.00.105:::
php_fusion	php_fusion	6.00.206	cpe:/a:php_fusion:php_fusion:6.00.206:::
php_fusion	php_fusion	6.00.110	cpe:/a:php_fusion:php_fusion:6.00.110:::
php_fusion	php_fusion	6.00.306	cpe:/a:php_fusion:php_fusion:6.00.306:::
php_fusion	php_fusion	6.00.204	cpe:/a:php_fusion:php_fusion:6.00.204:::
php_fusion	php_fusion	6.00.106	cpe:/a:php_fusion:php_fusion:6.00.106:::
php_fusion	php_fusion	6.00.303	cpe:/a:php_fusion:php_fusion:6.00.303:::
php_fusion	php_fusion	6.00.107	cpe:/a:php_fusion:php_fusion:6.00.107:::

Rows per page:

1-10 of 111

References

secunia.com/advisories/19992

securityreason.com/securityalert/194

securityreason.com/securityalert/873

www.osvdb.org/25538

www.osvdb.org/25539

www.php-fusion.co.uk/news.php

www.php-fusion.co.uk/news.php?readmore=321

www.securityfocus.com/archive/1/433277/100/0/threaded

www.securityfocus.com/bid/17898

www.vupen.com/english/advisories/2006/1735

exchange.xforce.ibmcloud.com/vulnerabilities/26389

CVSS2

6.4

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:P/A:N

AI Score

7.4

Confidence

Low

EPSS

0.006

Percentile

79.1%

JSON

Related for CVE-2006-2331

prion1 nvd1 cvelist1