Lucene search

MitreCVE-2006-6254

HistoryDec 04, 2006 - 11:28 a.m.

CVE-2006-6254

2006-12-0411:28:00

mitre

web.nvd.nist.gov

cahier de texte 2.0

administration

telecharger.php

cve-2006-6254

directory traversal

information security

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:M/Au:N/C:P/I:N/A:N

AI Score

7.2

Confidence

Low

EPSS

0.025

Percentile

90.2%

JSON

administration/telecharger.php in Cahier de texte 2.0 allows remote attackers to obtain unparsed content (source code) of files via the chemin parameter, as demonstrated using directory traversal sequences to obtain the MySQL username and password from conn_cahier_de_texte.php. NOTE: it is not clear whether the scope of this issue extends above the web document root, and whether directory traversal is the primary vulnerability.

Affected configurations

Nvd

Node

cahier_de_textescahier_de_textesRange≤2.2

cahier_de_textescahier_de_textesMatch2.0

VendorProductVersionCPE
cahier_de_textescahier_de_textes*cpe:2.3:a:cahier_de_textes:cahier_de_textes:*:*:*:*:*:*:*:*
cahier_de_textescahier_de_textes2.0cpe:2.3:a:cahier_de_textes:cahier_de_textes:2.0:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
cahier_de_textes	cahier_de_textes	*	cpe:2.3:a:cahier_de_textes:cahier_de_textes::::::::
cahier_de_textes	cahier_de_textes	2.0	cpe:2.3:a:cahier_de_textes:cahier_de_textes:2.0:::::::*

References

acid-root.new.fr/poc/15061124.txt

secunia.com/advisories/23122

securityreason.com/securityalert/1961

www.securityfocus.com/archive/1/452600/100/0/threaded

www.securityfocus.com/bid/21283

www.vupen.com/english/advisories/2006/4701

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:M/Au:N/C:P/I:N/A:N

AI Score

7.2

Confidence

Low

EPSS

0.025

Percentile

90.2%

JSON

Related for CVE-2006-6254