CVE-2006-4859 File upload in n/a
Remote attackers can upload PHP code via unrestricted file upload in the Contact component, leading to arbitrary code execution.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2006-4859?
CVE-2006-4859 is a high-severity vulnerability in n/a, published on 19 Sep 2006. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Unrestricted file upload vulnerability in contact.html.php in the Contact (com_contact) component in Limbo (aka Lite Mambo) CMS 1.0.4.2L and earlier allows remote attackers to upload PHP code to the images/contact folder via a filename with a double extension in the contact_attach parameter in a contact option in index.php, which bypasses an insufficiently restrictive regular expression.
Which versions are affected by CVE-2006-4859?
It affects 1 product.
Products include Limbo Cms Limbo Cms.
How do I fix CVE-2006-4859?
No fix has been published for CVE-2006-4859 yet. Limit exposure of the affected software until one is available.
Is CVE-2006-4859 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2006-4859 exists.
Public exploit code: 1 Exploit-DB entry.
Other vulnerabilities in n/a
Sources
Also known as GHSA-crg7-c4x5-jq8x.