PT-2006-6465 · E107 · E107

Kacper · Published 2006-11-07 · Updated 2017-10-19 · CVE-2006-5786

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions: e107 versions 0.7.5 and earlier

Description: A directory traversal issue exists, allowing remote attackers to read and execute PHP code in arbitrary files. This is achieved by using ".." sequences in the e107language e107cookie cookie to gsitemap.php.

Recommendations: For versions 0.7.5 and earlier, as a temporary workaround, consider restricting access to the gsitemap.php file until a patch is available. Avoid using the e107language e107cookie cookie with unvalidated input in the affected API endpoint until the issue is resolved.

Exploit

Fix

Related Identifiers

CVE-2006-5786

Affected Products

E107

References · 5

• 🔥 https://exploit-db.com/exploits/2711 · Exploit
• 🔥 http://securityfocus.com/bid/20913 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2006-5786 · Security Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-5786 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/30030 · Note