CVE

Id
20982  
CVE No.
CVE-2006-4878  
Status
Candidate  
Description
Directory traversal vulnerability in footer.php in David Bennett PHP-Post (PHPp) 1.0 and earlier allows remote attackers to read and include arbitrary local files via a .. (dot dot) sequence in the template parameter. NOTE: this was later reported to affect 1.0.1, and demonstrated for code execution by uploading and accessing an avatar file.  
Phase
Assigned (20060919)  
Votes
None (candidate not yet proposed)  
Comments
 

Actions

Related CVE References

Id CVE Id CVE No. Reference Actions
198866 20982 CVE-2006-4878 BUGTRAQ:20060916 PHP-Post Multiple Input Validation Vulnerabilities  View
198867 20982 CVE-2006-4878 URL:http://www.securityfocus.com/archive/1/archive/1/446318/100/0/threaded  View
198868 20982 CVE-2006-4878 MILW0RM:2593  View
198869 20982 CVE-2006-4878 URL:http://www.milw0rm.com/exploits/2593  View
198870 20982 CVE-2006-4878 BID:20061  View
198871 20982 CVE-2006-4878 URL:http://www.securityfocus.com/bid/20061  View
198872 20982 CVE-2006-4878 BID:20616  View
198873 20982 CVE-2006-4878 URL:http://www.securityfocus.com/bid/20616  View
198874 20982 CVE-2006-4878 VUPEN:ADV-2006-3688  View
198875 20982 CVE-2006-4878 URL:http://www.vupen.com/english/advisories/2006/3688  View
198876 20982 CVE-2006-4878 OSVDB:28964  View
198877 20982 CVE-2006-4878 URL:http://www.osvdb.org/28964  View
198878 20982 CVE-2006-4878 SECUNIA:22014  View
198879 20982 CVE-2006-4878 URL:http://secunia.com/advisories/22014  View
198880 20982 CVE-2006-4878 SREASON:1607  View
198881 20982 CVE-2006-4878 URL:http://securityreason.com/securityalert/1607  View
198882 20982 CVE-2006-4878 XF:phppost-template-code-execution(29673)  View

Related JVN

Id JVN No. Title Summary CVE No. CVE Id CVSS_v2 CVSS_v3 JVN URL Actions
59014 JVNDB-2006-001280 David Bennett PHPp における重要な情報を取得される脆弱性 David Bennett PHP-Post (PHPp) は、さまざまなエラーメッセージ内にインストールパスを表示する不備があるため、重要な情報を取得される脆弱性が存在します。 CVE-2006-4880 20982 5 http://jvndb.jvn.jp/ja/contents/2006/JVNDB-2006-001280.html  View