PEAR LiveUser 0.16.8 - Arbitrary File Access

PEAR LiveUser 0.16.8 - Arbitrary File Access PEAR LiveUser Arbitrary File Access Vendor: Markus Wolff Product: PEAR LiveUser Version: options'cookie''name'; if strlen$cookieData deleteRememberCookie; $this-stack-pushLIVEUSERERRORCOOKIE, 'error', array, 'Wrong data in cookie store in...

PEAR LiveUser < 0.16.8 - Arbitrary File Access

PEAR LiveUser Arbitrary File Access Vendor: Markus Wolff Product: PEAR LiveUser Version: options'cookie''name'; if strlen$cookieData deleteRememberCookie; $this-stack-pushLIVEUSERERRORCOOKIE, 'error', array, 'Wrong data in cookie store in LiveUser::readRememberMeCookie'; return false; $storeid =...

CVE-2006-0869

The CVE-2006-0869 entry concerns PEAR LiveUser before 0.16.9. A directory traversal flaw in the remember-me cookie handling (store_id) allows remote attackers to probe file existence and potentially read or delete arbitrary files on the server. Exploit details exist for PEAR LiveUser

CVE-2006-0869: Undefined Security Weakness

Directory traversal vulnerability in the "remember me" feature in liveuser.php in PHP Extension and Application Repository PEAR LiveUser 0.16.8 and earlier allows remote attackers to determine file existence, and possibly delete arbitrary files with short pathnames or possibly read arbitrary file...