CVE-2006-6254

administration/telecharger.php in Cahier de texte 2.0 allows remote attackers to obtain unparsed content (source code) of files via the chemin parameter, as demonstrated using directory traversal sequences to obtain the MySQL username and password from conn_cahier_de_texte.php. NOTE: it is not clear whether the scope of this issue extends above the web document root, and whether directory traversal is the primary vulnerability.

CVSS v2.0 4.3 MEDIUM

4.3^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:M/Au:N/C:P/I:N/A:N

Exploitability : 8.6 / Impact : 2.9

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact NONE

References

Link	Resource
http://acid-root.new.fr/poc/15061124.txt	Exploit
http://www.securityfocus.com/bid/21283	Exploit
http://secunia.com/advisories/23122	Exploit Vendor Advisory
http://securityreason.com/securityalert/1961
http://www.vupen.com/english/advisories/2006/4701
http://www.securityfocus.com/archive/1/452600/100/0/threaded

Advertisement

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:cahier_de_textes:cahier_de_textes:2.0:::::::*
	cpe:2.3:a:cahier_de_textes:cahier_de_textes::::::::

Information

Published : 2006-12-04 03:28

Updated : 2018-10-17 14:47

NVD link : CVE-2006-6254

Mitre link : CVE-2006-6254

JSON object : View

CWE

NVD-CWE-Other

Advertisement

Products Affected

cahier_de_textes

cahier_de_textes

{"cve": {"data_type": "CVE", "references": {"reference_data": [{"url": "http://acid-root.new.fr/poc/15061124.txt", "name": "http://acid-root.new.fr/poc/15061124.txt", "tags": ["Exploit"], "refsource": "MISC"}, {"url": "http://www.securityfocus.com/bid/21283", "name": "21283", "tags": ["Exploit"], "refsource": "BID"}, {"url": "http://secunia.com/advisories/23122", "name": "23122", "tags": ["Exploit", "Vendor Advisory"], "refsource": "SECUNIA"}, {"url": "http://securityreason.com/securityalert/1961", "name": "1961", "tags": [], "refsource": "SREASON"}, {"url": "http://www.vupen.com/english/advisories/2006/4701", "name": "ADV-2006-4701", "tags": [], "refsource": "VUPEN"}, {"url": "http://www.securityfocus.com/archive/1/452600/100/0/threaded", "name": "20061124 Cahier de texte V2.0 SQL Code Execution Exploit", "tags": [], "refsource": "BUGTRAQ"}]}, "data_format": "MITRE", "description": {"description_data": [{"lang": "en", "value": "administration/telecharger.php in Cahier de texte 2.0 allows remote attackers to obtain unparsed content (source code) of files via the chemin parameter, as demonstrated using directory traversal sequences to obtain the MySQL username and password from conn_cahier_de_texte.php. NOTE: it is not clear whether the scope of this issue extends above the web document root, and whether directory traversal is the primary vulnerability."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "en", "value": "NVD-CWE-Other"}]}]}, "data_version": "4.0", "CVE_data_meta": {"ID": "CVE-2006-6254", "ASSIGNER": "cve@mitre.org"}}, "impact": {"baseMetricV2": {"cvssV2": {"version": "2.0", "baseScore": 4.3, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "MEDIUM", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "severity": "MEDIUM", "impactScore": 2.9, "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}}, "publishedDate": "2006-12-04T11:28Z", "configurations": {"nodes": [{"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:a:cahier_de_textes:cahier_de_textes:2.0:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:cahier_de_textes:cahier_de_textes:*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true, "versionEndIncluding": "2.2"}]}], "CVE_data_version": "4.0"}, "lastModifiedDate": "2018-10-17T21:47Z"}