PT-2006-6883 · Unknown · Cahier De Texte

Darkfig · Published 2006-12-04 · Updated 2018-10-17 · CVE-2006-6254

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Cahier de texte version 2.0

Description The issue allows remote attackers to obtain unparsed content, specifically source code, of files. This is achieved via the chemin parameter in the administration/telecharger.php file. An example of exploitation includes using directory traversal sequences to access sensitive information, such as the MySQL username and password from conn cahier de texte.php. The full scope of this issue, including whether it extends beyond the web document root and the primary nature of the vulnerability, is not entirely clear.

Recommendations For Cahier de texte version 2.0, consider restricting access to the administration/telecharger.php file and the chemin parameter to minimize the risk of exploitation. As a temporary workaround, restrict directory traversal to prevent unauthorized access to sensitive files.

Exploit

Fix

Related Identifiers

CVE-2006-6254

Affected Products

Cahier De Texte

References · 8

• 🔥 https://exploit-db.com/exploits/2844 · Exploit
• 🔥 http://securityfocus.com/bid/21283 · Exploit
• 🔥 http://acid-root.new.fr/poc/15061124.txt · Exploit
• 🔥 http://secunia.com/advisories/23122 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2006-6254 · Security Note
• http://vupen.com/english/advisories/2006/4701 · Note
• http://securityreason.com/securityalert/1961 · Note
• http://securityfocus.com/archive/1/452600/100/0/threaded · Note