CVE-2006-0899

Directory traversal vulnerability in index.php in 4Images 1.7.1 and earlier allows remote attackers to read and include arbitrary files via ".." (dot dot) sequences in the template parameter.

Published Bycve@mitre.org

Published DateFeb 27, 2006, 19:06

Weakness Type (CWE):NVD-CWE-Other

CVSS Metrics

Base Score

7.5

Vector String

AV:N/AC:L/Au:N/C:P/I:P/A:P

Base Severity

Version

2.0

Attack Vector (AV)

Attack Complexity (AC)

Privileges Required (PR)

User Interaction (UI)

Scope (S)

Confidentiality (C)

PARTIAL

Integrity (I)

PARTIAL

Availability (A)

PARTIAL

References

http://retrogod.altervista.org/4images_171_adv.html
http://secunia.com/advisories/19026
http://securityreason.com/securityalert/518
http://www.osvdb.org/23529
http://www.securityfocus.com/archive/1/426468/100/0/threaded
http://www.securityfocus.com/bid/16855
http://www.vupen.com/english/advisories/2006/0754
https://exchange.xforce.ibmcloud.com/vulnerabilities/24938
https://www.exploit-db.com/exploits/1533

Weakness Type (CWE):NVD-CWE-Other

CVSS Metrics

Base Score

7.5

Vector String

AV:N/AC:L/Au:N/C:P/I:P/A:P

Base Severity

Version

2.0

Attack Vector (AV)

Attack Complexity (AC)

Privileges Required (PR)

User Interaction (UI)

Scope (S)

Confidentiality (C)

PARTIAL

Integrity (I)

PARTIAL

Availability (A)

PARTIAL