CVE-2006-0445 Information disclosure in n/a
Authenticated users can obtain the installation path by submitting an invalid filename to the uploader page, revealing sensitive server directory information.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2006-0445?
CVE-2006-0445 is a medium-severity vulnerability in n/a, published on 26 Jan 2006. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
index.php in Phpclanwebsite 1.23.1 allows remote authenticated users to obtain the installation path by specifying an invalid file name to the uploader page, as demonstrated by "\", which will display the full path of uploader.php. NOTE: this might be the result of a file inclusion vulnerability.
Which versions are affected by CVE-2006-0445?
It affects 1 product.
Products include Phpclanwebsite Phpclanwebsite.
How do I fix CVE-2006-0445?
No fix has been published for CVE-2006-0445 yet. Limit exposure of the affected software until one is available.
Is CVE-2006-0445 being exploited?
There is no known exploitation of CVE-2006-0445 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as GHSA-fp6x-cwxh-3wvm.