CVE-2006-6254 Path traversal in n/a
Remote attackers can read source code and database credentials via directory traversal in the chemin parameter of Cahier de texte.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2006-6254?
CVE-2006-6254 is a medium-severity path traversal vulnerability in n/a, published on 4 Dec 2006. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
administration/telecharger.php in Cahier de texte 2.0 allows remote attackers to obtain unparsed content (source code) of files via the chemin parameter, as demonstrated using directory traversal sequences to obtain the MySQL username and password from conn_cahier_de_texte.php. NOTE: it is not clear whether the scope of this issue extends above the web document root, and whether directory traversal is the primary vulnerability.
Which versions are affected by CVE-2006-6254?
It affects 1 product.
Products include Cahier De Textes Cahier De Textes.
How do I fix CVE-2006-6254?
No fix has been published for CVE-2006-6254 yet. Limit exposure of the affected software until one is available.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2006-6254 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2006-6254 exists.
Public exploit code: 1 Exploit-DB entry.
Other vulnerabilities in n/a
Sources
Also known as GHSA-w6mj-7r32-h757.