CVE-2006-1925 Path traversal in n/a
Remote attackers with low privileges can read or modify arbitrary files via directory traversal in CuteNews, potentially leading to XSS.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2006-1925?
CVE-2006-1925 is a medium-severity path traversal vulnerability in n/a, published on 20 Apr 2006. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Directory traversal vulnerability in the editnews module (inc/editnews.mdu) in index.php in CuteNews 1.4.1 allows remote attackers to read or modify files via the source parameter in the (1) editnews or (2) doeditnews action. NOTE: this can also produce resultant XSS when the target file does not exist.
Which versions are affected by CVE-2006-1925?
It affects 1 product.
Products include Cutephp Cutenews.
How do I fix CVE-2006-1925?
No fix has been published for CVE-2006-1925 yet. Limit exposure of the affected software until one is available.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2006-1925 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2006-1925 exists.
Public exploit code: 1 Exploit-DB entry.
Other vulnerabilities in n/a
Sources
Also known as GHSA-j5gv-vx6f-v4r6.