CVE-2006-0660

23Vexday Risk Score

No sign of exploitation. It has a public proof of concept.

ssvc Attendepss 4.7%

from disclosure to weapon0 days

Published on NVDFeb 13

1st PoCFeb 10

exploitation probability

4.7%top 9% of all CVEs

observed exploitation

nono source reports it

2 public exploit(s)

Multiple directory traversal vulnerabilities in FarsiNews 2.5 and earlier allows remote attackers to (1) read arbitrary files or trigger an error message path disclosure via ".." or invalid names in the archive parameter to index.php, or (2) include arbitrary files via the template parameter to show_archives.php.

Affected products

n/a · n/a

public PoCs found — 2✓ VexDay Proof

exploitdb✓ VexDay Proofwww.exploit-db.com/exploits/27183 exploitdb✓ VexDay Proofwww.exploit-db.com/exploits/1538

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

References

http://forum.farsinewsteam.com/index.php?showtopic=71 http://forum.farsinewsteam.com/index.php?showtopic=76 http://secunia.com/advisories/18768 https://exchange.xforce.ibmcloud.com/vulnerabilities/24598 https://exchange.xforce.ibmcloud.com/vulnerabilities/24602 http://www.hamid.ir/security/farsinews2-5.txt http://www.osvdb.org/23020 http://www.osvdb.org/23021 http://www.osvdb.org/23022 http://www.securityfocus.com/archive/1/424720/100/0/threaded http://www.securityfocus.com/bid/16580 http://www.vupen.com/english/advisories/2006/0506