NVD

Id
59375  
Name
CVE-2006-0644  
Description
Multiple directory traversal vulnerabilities in install.php in CPG-Nuke Dragonfly CMS (aka CPG Dragonfly CMS) 9.0.6.1 allow remote attackers to include and execute arbitrary local files via directory traversal sequences and a NUL (%00) character in (1) the newlang parameter and (2) the installlang parameter in a cookie, as demonstrated by using error.php to insert malicious code into a log file, or uploading a malicious .png file, which is then included using install.php.  
Reject
 
CVSS Version
2  
CVSS Score
7.5  
Severity
High  
CVSS Base Score
7.5  
CVSS Impact Subscore
6.4  
CVSS Exploit Subscore
10  
CVSS Vector
(AV:N/AC:L/Au:N/C:P/I:P/A:P)  
Pub Date
2016-12-20  
Published
2006-02-10  
Modified Date
2008-09-05  
Seq
2006-0644  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
305250 59375 CVE-2006-0644 http://dragonflycms.org/Forums/viewtopic/p=98034.html  View
305251 59375 CVE-2006-0644 http://dragonflycms.org/Forums/viewtopic/p=98034.html#98034  View
305252 59375 CVE-2006-0644 http://retrogod.altervista.org/dragonfly9.0.6.1_incl_xpl.html  View
305253 59375 CVE-2006-0644 1015601  View
305254 59375 CVE-2006-0644 20060208 CPGNuke Dragonfly 9.0.6.1 remote commands execution through arbitrary local inclusion  View
305255 59375 CVE-2006-0644 16546  View
305256 59375 CVE-2006-0644 cpg-dragonfly-file-include(24660)  View

Related JVN