CVE-2006-1201 - Secunia Advisories - Vulnerability Intelligence

CVE Reference: CVE-2006-1201
NOTE: The text on this page is written by CVE MITRE and reflects neither the opinions of Secunia or the results of our research. All data on this page is written and maintained by CVE MITRE.

Original Page at CVE MITRE: CVE-2006-1201

Description: Directory traversal vulnerability in resetpw.php in eschew.net phpBannerExchange 2.0 and earlier, and other versions before 2.0 Update 5, allows remote attackers to read arbitrary files via a .. (dot dot) in the email parameter during a "Recover password" operation (recoverpw.php).

CVE Status: Candidate

References: XF http://xforce.iss.net/xforce/xfdb/25071 http://xforce.iss.net/xforce/xfdb/25080 SAID Secunia Advisory: SA19127 OSVDB 23720 MISC http://www.h4cky0u.org/advisories/HYSA-2006-004-phpbanner.txt FULLDISC http://archives.neohapsis.com/archives/fulldisclosure/2006-02/0879.html CONFIRM http://www.eschew.net/scripts/phpbe/2.0/releasenotes.php BUGTRAQ http://www.securityfocus.com/archive/1/archive/1/426940/100/0/threaded BID 16996

Return to the previous page.