PRIOn knowledge basePRION:CVE-2006-2060Directory traversal
7.3 High
AI Score
Confidence
Low
6.4 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:L/Au:N/C:P/I:P/A:N
0.006 Low
EPSS
Percentile
77.3%
Directory traversal vulnerability in action_admin/paysubscriptions.php in Invision Power Board (IPB) 2.1.x and 2.0.x before 20060425 allows remote authenticated administrators to include and execute arbitrary local PHP files via a … (dot dot) in the name parameter, preceded by enough backspace (%08) characters to erase the initial static portion of a filename.
| CPE | Name | Operator | Version |
|---|---|---|---|
| invision_power_board | eq | 2.0.120 | |
| invision_power_board | eq | 2.1.120 |
References
forums.invisionpower.com/index.php?showtopic=213374
secunia.com/advisories/19830
securityreason.com/securityalert/796
www.osvdb.org/25008
www.securityfocus.com/archive/1/431990/100/0/threaded
www.securityfocus.com/archive/1/432226/100/0/threaded
www.securityfocus.com/archive/1/439607/100/0/threaded
www.vupen.com/english/advisories/2006/1534
exchange.xforce.ibmcloud.com/vulnerabilities/26072
Related
7.3 High
AI Score
Confidence
Low
6.4 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:L/Au:N/C:P/I:P/A:N
0.006 Low
EPSS
Percentile
77.3%