CVE-2006-4298 Path traversal in n/a
Remote attackers can determine file existence and disclose installation paths via directory traversal in osCommerce cache functions.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2006-4298?
CVE-2006-4298 is a medium-severity path traversal vulnerability in Oscommerce Oscommerce, published on 23 Aug 2006. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Multiple directory traversal vulnerabilities in cache.php in osCommerce before 2.2 Milestone 2 060817 allow remote attackers to determine existence of arbitrary files and disclose the installation path via a .. (dot dot) in unspecified parameters in the (1) tep_cache_also_purchased, (2) tep_cache_manufacturers_box, and (3) tep_cache_categories_box functions.
Which versions are affected by CVE-2006-4298?
It affects 1 product.
Products include Oscommerce Oscommerce.
How do I fix CVE-2006-4298?
No fix has been published for CVE-2006-4298 yet. Limit exposure of the affected software until one is available.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2006-4298 being exploited?
There is no known exploitation of CVE-2006-4298 in the wild and no public exploit code.
Other vulnerabilities in Oscommerce Oscommerce
Sources
Also known as GHSA-mj42-rq3r-4p7q.