CVE-2006-0936 File upload in n/a
Administrative users can upload and execute arbitrary files via a null byte injection in the filename parameter.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2006-0936?
CVE-2006-0936 is a medium-severity vulnerability in n/a, published on 28 Feb 2006. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
Free Host Shop Website Generator 3.3 allows remote authenticated users with administrative privileges to upload and execute arbitrary files via a formname parameter with a filename containing a dangerous file extension and a trailing %00.
Which versions are affected by CVE-2006-0936?
It affects 1 product.
Products include Free Host Shop Website Generator.
How do I fix CVE-2006-0936?
No fix has been published for CVE-2006-0936 yet. Limit exposure of the affected software until one is available.
Is CVE-2006-0936 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2006-0936 exists.
Public exploit code: 1 Exploit-DB entry.
Sources
Also known as GHSA-7m9f-4v5m-4qc7.