Lucene search

[email protected]CVE-2006-5894

HistoryNov 14, 2006 - 10:07 p.m.

CVE-2006-5894

2006-11-1422:07:00

[email protected]

web.nvd.nist.gov

cve

2006

5894

directory traversal

rama cms

vulnerability

lang.php

register_globals

remote attackers

apache http server

nvd

6.8 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

7.6 High

AI Score

Confidence

Low

0.013 Low

EPSS

Percentile

86.2%

JSON

Directory traversal vulnerability in lang.php in Rama CMS 0.68 and earlier, when register_globals is enabled, allows remote attackers to include and execute arbitrary local files via a … (dot dot) in the lang cookie, as demonstrated by injecting PHP sequences into an Apache HTTP Server log file, which is then included by lang.php.

Affected configurations

NVD

Node

rama_cmsrama_cmsRange≤0.68

CPENameOperatorVersion
rama_cms:rama_cmsrama cmsle0.68

CPE	Name	Operator	Version
rama_cms:rama_cms	rama cms	le	0.68

References

secunia.com/advisories/22847

www.rahim.webd.pl/exploit127.html

www.securityfocus.com/bid/21009

www.vupen.com/english/advisories/2006/4473

exchange.xforce.ibmcloud.com/vulnerabilities/30183

www.exploit-db.com/exploits/2760

6.8 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

7.6 High

AI Score

Confidence

Low

0.013 Low

EPSS

Percentile

86.2%

JSON

Related for CVE-2006-5894

nvd1 cvelist1