CVE-2006-4913

EPSS 9.5%

Directory traversal vulnerability in chat/getStartOptions.php in AlstraSoft E-friends 4.85 allows remote attackers to include arbitrary local files and possibly execute arbitrary code via a .. (dot dot) sequence and trailing null (%00) byte in the lang parameter, as demonstrated by injecting PHP code into a log file.

Affected products

n/a · n/a

public PoCs found — 1

cve_referencewww.exploit-db.com/exploits/2389unverified

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →

References

http://secunia.com/advisories/21961 https://exchange.xforce.ibmcloud.com/vulnerabilities/29006 https://www.exploit-db.com/exploits/2389 http://www.securityfocus.com/bid/20088 http://www.vupen.com/english/advisories/2006/3684