PT-2006-4257 · V3 · V3 Chat

Published 2006-07-06 · Updated 2018-10-18 · CVE-2006-3365

Positive Technologies (AI Summary)

CVSS v2.0

2.6

Low

Base vector

AV:N/AC:H/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions V3 Chat (affected versions not specified)

Description The issue allows remote attackers to obtain the installation path. This can be achieved through an invalid id parameter to the "mail/index.php" API endpoint or a membername parameter to the "messenger/online.php" API endpoint. The path is displayed in an error page due to an incorrect SQL statement.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2006-3365

Affected Products

V3 Chat

References · 7

• 🔥 http://securitytracker.com/id?1016340 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2006-3365 · Security Note
• http://vupen.com/english/advisories/2006/2474 · Vendor Advisory
• http://securityfocus.com/archive/1/438069/100/200/threaded · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/27395 · Note
• http://securityfocus.com/archive/1/437755/100/200/threaded · Note
• http://securityfocus.com/bid/18543 · Note