Lucene search

[email protected]CVE-2006-2532

HistoryMay 22, 2006 - 11:10 p.m.

CVE-2006-2532

2006-05-2223:10:00

[email protected]

web.nvd.nist.gov

cve-2006-2532

destiney rated images script

stats.php

remote attack

installation path disclosure

nvd

6.4 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:P/A:N

7.1 High

AI Score

Confidence

Low

0.004 Low

EPSS

Percentile

73.2%

JSON

stats.php in Destiney Rated Images Script 0.5.0 allows remote attackers to obtain the installation path via an invalid s parameter, which displays the path in an error message. NOTE: this issue was originally claimed to be SQL injection, but CVE analysis shows that the problem is related to an invalid value that prevents some variables from being set.

Affected configurations

NVD

Node

greg_donalddestiney_rated_images_scriptMatch0.5.0

CPENameOperatorVersion
greg_donald:destiney_rated_images_scriptgreg donald destiney rated images scripteq0.5.0

CPE	Name	Operator	Version
greg_donald:destiney_rated_images_script	greg donald destiney rated images script	eq	0.5.0

References

securityreason.com/securityalert/940

www.securityfocus.com/archive/1/434691/100/0/threaded

exchange.xforce.ibmcloud.com/vulnerabilities/26603

6.4 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:P/A:N

7.1 High

AI Score

Confidence

Low

0.004 Low

EPSS

Percentile

73.2%

JSON

Related for CVE-2006-2532

prion1 cvelist1 nvd1