CVE-2006-0891 Path traversal in n/a

Medium 5.0 Published 25 Feb 2006 Updated 7 Aug 2024

Remote attackers can execute arbitrary code or read files via path traversal in NOCC Webmail, requiring low privileges and specific configuration.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2006-0891?

CVE-2006-0891 is a medium-severity path traversal vulnerability in n/a, published on 25 Feb 2006. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

Multiple directory traversal vulnerabilities in NOCC Webmail 1.0 allow remote attackers to include arbitrary files via .. (dot dot) sequences and a trailing NULL (%00) byte in (1) the _SESSION['nocc_theme'] parameter in (a) html/footer.php; and (2) the lang and (3) theme parameters and the (4) Accept-Language HTTP header field, when force_default_lang is disabled, in (b) index.php, as demonstrated by injecting PHP code into a profile and accessing it using the lang parameter in index.php.

Which versions are affected by CVE-2006-0891?

It affects 1 product.

Products include Nocc Nocc.

How do I fix CVE-2006-0891?

No fix has been published for CVE-2006-0891 yet. Limit exposure of the affected software until one is available.

Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.

Is CVE-2006-0891 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2006-0891 exists.

Public exploit code: 1 Exploit-DB entry.

Sources

Also known as GHSA-mhqw-4hwc-5m2q.