PT-2006-5366 · Unknown · The Address Book

Published 2006-12-31 · Updated 2017-07-20 · CVE-2006-4579

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions The Address Book version 1.04e

Description A directory traversal issue exists, allowing remote attackers to include arbitrary files. This is achieved by using a .. (dot dot) in the language parameter of the users.php file.

Recommendations For version 1.04e, consider restricting access to the users.php file until a patch is available, or apply configuration changes to prevent directory traversal attacks, such as validating and sanitizing the language parameter to prevent inclusion of arbitrary files.

Exploit

Fix

Related Identifiers

CVE-2006-4579

Affected Products

The Address Book

References · 6

• 🔥 http://secunia.com/advisories/21694 · Exploit
• 🔥 http://secunia.com/secunia_research/2006-76/advisory · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2006-4579 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/31246 · Note
• http://securityfocus.com/bid/21870 · Note
• http://osvdb.org/32562 · Note