CVE-2006-0169 - addresses.php3 in MyPhPim 01.05 does not restrict uploaded files, which allows remote attackers to e

CVE-2006-0169

Summary

addresses.php3 in MyPhPim 01.05 does not restrict uploaded files, which allows remote attackers to execute arbitrary PHP code via the pdbfile variable, then directly accessing those files from the uploads directory.

References

http://evuln.com/vulns/23/summary.html
http://secunia.com/advisories/18399
http://www.securityfocus.com/archive/1/421626/100/0/threaded
http://www.securityfocus.com/bid/16208
http://www.vupen.com/english/advisories/2006/0147
https://exchange.xforce.ibmcloud.com/vulnerabilities/24070

Vulnerable Configurations

cpe:2.3:a:myphpim:myphpim:01.05:*:*:*:*:*:*:*
cpe:2.3:a:myphpim:myphpim:01.05:*:*:*:*:*:*:*

CVSS

Base:	7.5 (as of 19-10-2018 - 15:43)
Impact:
Exploitability:

CWE

NVD-CWE-Other

CAPEC

Access

Vector	Complexity	Authentication
NETWORK	LOW	NONE

Impact

Confidentiality	Integrity	Availability
PARTIAL	PARTIAL	PARTIAL

cvss-vector via4

AV:N/AC:L/Au:N/C:P/I:P/A:P

refmap via4

bid	16208
bugtraq	20060111 [eVuln] MyPhPim Arbitrary File Upload
misc	http://evuln.com/vulns/23/summary.html
secunia	18399
vupen	ADV-2006-0147
xf	myphpim-addresses-file-upload(24070)

Last major update

19-10-2018 - 15:43

Published

11-01-2006 - 21:03

Last modified

19-10-2018 - 15:43