CVE-2006-4458

EPSS 3.2%

Directory traversal vulnerability in calendar/inc/class.holidaycalc.inc.php in phpGroupWare 0.9.16.010 and earlier allows remote attackers to include arbitrary local files via a .. (dot dot) sequence and trailing null (%00) byte in the GLOBALS[phpgw_info][user][preferences][common][country] parameter.

Affected products

n/a · n/a

public PoCs found — 1

cve_referencewww.exploit-db.com/exploits/2270unverified

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →

References

http://secunia.com/advisories/21687 https://exchange.xforce.ibmcloud.com/vulnerabilities/28627 https://www.exploit-db.com/exploits/2270 http://www.securityfocus.com/bid/19751 http://www.vupen.com/english/advisories/2006/3414