PT-2006-2753 · Blur6Ex · Blur6Ex

Steven M. Christey · Published 2006-04-13 · Updated 2018-10-18 · CVE-2006-1762

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions blur6ex version 0.3.452

Description The issue is a directory traversal vulnerability in the index.php file, which allows remote attackers to include arbitrary files via the shard parameter. This can be exploited to produce resultant XSS when the parameter has XSS manipulations, and path disclosure with other invalid values.

Recommendations For blur6ex version 0.3.452, consider restricting access to the shard parameter in the index.php file to minimize the risk of exploitation. As a temporary workaround, avoid using the shard parameter with potentially malicious input until a fix is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Related Identifiers

CVE-2006-1762

Affected Products

Blur6Ex

References · 7

• 🔥 http://securityfocus.com/bid/17465 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2006-1762 · Security Note
• http://securityfocus.com/archive/1/491565/100/0/threaded · Note
• http://securityfocus.com/archive/1/430607/100/0/threaded · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/25758 · Note
• http://attrition.org/pipermail/vim/2006-April/000691.html · Note
• http://securityfocus.com/archive/1/430885/100/0/threaded · Note