PT-2006-7206 · Torrentflux · Torrentflux

R0Ut3R · Published 2006-12-15 · Updated 2017-10-19 · CVE-2006-6604

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions TorrentFlux version 2.2

Description A directory traversal issue exists, allowing remote authenticated users to read arbitrary files. This is achieved by using .. (dot dot) sequences in the alias parameter of the downloaddetails.php file.

Recommendations For TorrentFlux version 2.2, restrict access to the downloaddetails.php file until a patch is available, and avoid using the alias parameter with .. sequences to minimize the risk of exploitation.

Exploit

Fix

Related Identifiers

CVE-2006-6604

Affected Products

Torrentflux

References · 6

• 🔥 https://exploit-db.com/exploits/2902 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2006-6604 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/30831 · Note
• http://secunia.com/advisories/23270 · Note
• http://securityfocus.com/bid/21525 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-6604 · Note