Lucene search

[email protected]CVE-2006-5115

HistoryOct 03, 2006 - 4:03 a.m.

CVE-2006-5115

2006-10-0304:03:00

[email protected]

web.nvd.nist.gov

cve

directory traversal

vulnerability

kgcall.php

kgb 1.87

remote attackers

arbitrary local files

php code

5.1 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

HIGH

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:H/Au:N/C:P/I:P/A:P

7.7 High

AI Score

Confidence

Low

0.016 Low

EPSS

Percentile

87.5%

JSON

Directory traversal vulnerability in kgcall.php in KGB 1.87 allows remote attackers to include and execute arbitrary local files via a … (dot dot) in the engine parameter, as demonstrated by uploading a file containing PHP code with an image/jpeg content type, and then referencing this file through the engine parameter.

Affected configurations

NVD

Node

kgbkgbMatch1.87

CPENameOperatorVersion
kgb:kgbkgbeq1.87

CPE	Name	Operator	Version
kgb:kgb	kgb	eq	1.87

References

secunia.com/advisories/22152

www.securityfocus.com/bid/20258

www.vupen.com/english/advisories/2006/3844

exchange.xforce.ibmcloud.com/vulnerabilities/29235

www.exploit-db.com/exploits/2447

5.1 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

HIGH

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:H/Au:N/C:P/I:P/A:P

7.7 High

AI Score

Confidence

Low

0.016 Low

EPSS

Percentile

87.5%

JSON

Related for CVE-2006-5115

nvd1 cvelist1