CVE-2006-6047 Directory traversal vulnerability in manager/index.php in Etomite 0.6.1.2 allows remote authenticated administrators to include and execute arbitrary local files via a .. (dot dot) in the f parameter,...
MediumCVSS 5.8
EPSS 8.3%
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
Directory traversal vulnerability in manager/index.php in Etomite 0.6.1.2 allows remote authenticated administrators to include and execute arbitrary local files via a .. (dot dot) in the f parameter, as demonstrated by injecting PHP sequences into an Apache HTTP Server log file, which is then included by index.php.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| etomite | = 0.6.1.2 | No fix listed |
References
- 22885 third-party-advisory vendor-advisory
- www.0xcafebabe.it exploit
- www.etomite.org
- 20061116 Etomite CMS 0.6.1.2 Multiple Vulnerabilities ( Sql Injection + Local file inclusion ) mailing-list
- 20061117 Re: Etomite CMS 0.6.1.2 Multiple Vulnerabilities ( Sql Injection + Local file inclusion ) mailing-list
- 21135 vdb-entry
- ADV-2006-4558 vdb-entry vendor-advisory
- etomite-index-file-include(30329) vdb-entry
- 2790 exploit