CVE-2006-6678 Command injection in n/a
Attackers can execute arbitrary commands via shell metacharacters in filenames during textarea editing in Netrik.
- Exploited in the wild
- Not known
- Login needed
- Not stated
- Attackable
- Not stated
- Victim action needed
- Not stated
- Fix
- Available
What is CVE-2006-6678?
CVE-2006-6678 is a high-severity command injection vulnerability in n/a, published on 21 Dec 2006.
Official description
The edit_textarea function in form-file.c in Netrik 1.15.4 and earlier does not properly verify temporary filenames when editing textarea fields, which allows attackers to execute arbitrary commands via shell metacharacters in the filename.
Which versions are affected by CVE-2006-6678?
It affects 1 product.
Products include Netrik Netrik.
How do I fix CVE-2006-6678?
Apply the vendor's patch.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2006-6678 being exploited?
There is no known exploitation of CVE-2006-6678 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2006-6678, DSA-1251-1, GHSA-37rp-7j34-hmr2.