PT-2006-6749 · Lifetype · Lifetype

Jesper Jurcenoks · Published 2006-12-06 · Updated 2018-10-17 · CVE-2006-6112

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions LifeType versions 1.0.x through 1.1.x

Description The issue is related to insufficient access control for PHP scripts under specific directories, allowing remote attackers to obtain the installation path. This can be achieved by making a direct request to certain scripts, such as bayesianfilter.class.php and bootstrap.php, which may leak the path in an error message.

Recommendations For LifeType versions 1.0.x through 1.1.x, consider restricting direct access to the PHP scripts under the class/ and plugins/ directories to prevent remote attackers from obtaining the installation path. As a temporary workaround, restrict access to the bayesianfilter.class.php and bootstrap.php scripts until a proper fix is applied.

Exploit

Fix

Related Identifiers

CVE-2006-6112

Affected Products

Lifetype

References · 8

• 🔥 http://netvigilance.com/advisory0008 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2006-6112 · Security Note
• http://lifetype.net/blog.php/lifetype-development-journal/2006/11/30/full_path_disclosure_vulnerability_in_lifetype_1.0.x_and_1.1.x · Vendor Advisory
• http://osvdb.org/30685 · Vendor Advisory
• http://securityreason.com/securityalert/1980 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-6112 · Note
• http://securityfocus.com/archive/1/453135/100/0/threaded · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/30635 · Note