CVE-2006-6694

EPSS 2.4%

Directory traversal vulnerability in include/config.php in E-Uploader Pro 1.0 and earlier allows remote attackers to execute arbitrary PHP code via a .. (dot dot) in the language parameter, as demonstrated by uploading a .JPG file containing PHP code, then accessing the file via config.php.

Affected products

n/a · n/a

public PoCs found — 1

cve_referencewww.exploit-db.com/exploits/2556unverified

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →

References

http://secunia.com/advisories/22314 https://exchange.xforce.ibmcloud.com/vulnerabilities/29574 https://www.exploit-db.com/exploits/2556 http://www.rahim.webd.pl/exploity/Exploits/99.txt http://www.securityfocus.com/bid/20481