CVE-2006-0713
Gravedad CVSS v2.0:
MEDIA
Tipo:
No Disponible / Otro tipo
Fecha de publicación:
15/02/2006
Última modificación:
19/10/2018
Descripción
*** Pendiente de traducción *** Directory traversal vulnerability in LinPHA 1.0 allows remote attackers to include arbitrary files via .. (dot dot) sequences in the (1) lang parameter in docs/index.php and the language parameter in (2) install/install.php, (3) install/sec_stage_install.php, (4) install/third_stage_install.php, and (5) install/forth_stage_install.php. NOTE: direct static code injection is resultant from this issue, as demonstrated by inserting PHP code into the username, which is inserted into linpha.log, which is accessible from the directory traversal.
Impacto
Puntuación base 2.0
5.00
Gravedad 2.0
MEDIA
Productos y versiones vulnerables
CPE | Desde | Hasta |
---|---|---|
cpe:2.3:a:linpha:linpha:0.9.0:*:*:*:*:*:*:* | ||
cpe:2.3:a:linpha:linpha:0.9.1:*:*:*:*:*:*:* | ||
cpe:2.3:a:linpha:linpha:0.9.2:*:*:*:*:*:*:* | ||
cpe:2.3:a:linpha:linpha:0.9.3:*:*:*:*:*:*:* | ||
cpe:2.3:a:linpha:linpha:0.9.4:*:*:*:*:*:*:* | ||
cpe:2.3:a:linpha:linpha:1.0:*:*:*:*:*:*:* |
Para consultar la lista completa de nombres de CPE con productos y versiones, ver esta página
Referencias a soluciones, herramientas e información
- http://retrogod.altervista.org/linpha_10_local.html
- http://secunia.com/advisories/18808
- http://securityreason.com/securityalert/426
- http://www.securityfocus.com/archive/1/424729/100/0/threaded
- http://www.securityfocus.com/bid/16592
- http://www.vupen.com/english/advisories/2006/0535
- https://exchange.xforce.ibmcloud.com/vulnerabilities/24663