CVE-2006-0695 - Ansilove before 1.03 does not filter uploaded file extensions, which allows remote attackers to exec

CVE-2006-0695

Summary

Ansilove before 1.03 does not filter uploaded file extensions, which allows remote attackers to execute arbitrary code by uploading arbitrary files with dangerous extensions, then accessing them directly in the upload directory.

References

http://secunia.com/advisories/18810
http://sourceforge.net/project/shownotes.php?release_id=392826
http://www.securityfocus.com/bid/16603
http://www.vupen.com/english/advisories/2006/0536
https://exchange.xforce.ibmcloud.com/vulnerabilities/24684

Vulnerable Configurations

cpe:2.3:a:ansilove:ansilove:1.01:*:*:*:*:*:*:*
cpe:2.3:a:ansilove:ansilove:1.01:*:*:*:*:*:*:*
cpe:2.3:a:ansilove:ansilove:1.02:*:*:*:*:*:*:*
cpe:2.3:a:ansilove:ansilove:1.02:*:*:*:*:*:*:*

CVSS

Base:	7.5 (as of 20-07-2017 - 01:29)
Impact:
Exploitability:

CWE

NVD-CWE-Other

CAPEC

Access

Vector	Complexity	Authentication
NETWORK	LOW	NONE

Impact

Confidentiality	Integrity	Availability
PARTIAL	PARTIAL	PARTIAL

cvss-vector via4

AV:N/AC:L/Au:N/C:P/I:P/A:P

refmap via4

bid	16603
confirm	http://sourceforge.net/project/shownotes.php?release_id=392826
secunia	18810
vupen	ADV-2006-0536
xf	ansilove-filename-code-execution(24684)

Last major update

20-07-2017 - 01:29

Published

15-02-2006 - 11:06

Last modified

20-07-2017 - 01:29