[Forgot Password]
Login  Register Subscribe

24128

 
 

131615

 
 

112994

 
 

909

 
 

87812

 
 

136

Paid content will be excluded from the download.


Download | Alert*
CVE
view XML view JSON

CVE-2005-3347Date: (C)2005-11-17   (M)2018-02-19


Multiple directory traversal vulnerabilities in index.php in phpSysInfo 2.4 and earlier, as used in phpgroupware 0.9.16 and earlier, and egrouwpware before 1.0.0.009, allow remote attackers to include arbitrary files via .. (dot dot) sequences in the (1) sensor_program parameter or the (2) _SERVER[HTTP_ACCEPT_LANGUAGE] parameter, which overwrites an internal variable, a variant of CVE-2003-0536. NOTE: due to a typo in an advisory, an issue in osh was inadvertently linked to this identifier; the proper identifier for the osh issue is CVE-2005-3346.

CVSS Score and Metrics +CVSS Score and Metrics -

CVSS V2 Severity:
CVSS Score : 6.8
Exploit Score: 8.6
Impact Score: 6.4
 
CVSS V2 Metrics:
Access Vector: NETWORK
Access Complexity: MEDIUM
Authentication: NONE
Confidentiality: PARTIAL
Integrity: PARTIAL
Availability: PARTIAL
  
Reference:
BID-15396
BID-15414
SECUNIA-17441
SECUNIA-17570
SECUNIA-17584
SECUNIA-17616
SECUNIA-17620
SECUNIA-17643
SECUNIA-17698
http://www.securityfocus.com/archive/1/416543
DSA-897
DSA-898
DSA-899
GLSA-200511-18
MDKSA-2005:212
http://www.hardened-php.net/advisory_212005.81.html
phpsysinfo-registerglobal-data-manipulation(23107)

CWE    1
CWE-22

© SecPod Technologies