CVE-2006-6403 - mystats.php in MyStats 1.0.8 and earlier allows remote attackers to obtain the installation path via

CVE-2006-6403

Summary

mystats.php in MyStats 1.0.8 and earlier allows remote attackers to obtain the installation path via (1) details and (2) by array parameters, probably resulting in a path disclosure in an error message.

References

http://marc.info/?l=bugtraq&m=116344068502988&w=2
http://securitytracker.com/id?1017210
https://exchange.xforce.ibmcloud.com/vulnerabilities/30213

Vulnerable Configurations

cpe:2.3:a:mystats:mystats:*:*:*:*:*:*:*:*
cpe:2.3:a:mystats:mystats:*:*:*:*:*:*:*:*

CVSS

Base:	5.0 (as of 29-07-2017 - 01:29)
Impact:
Exploitability:

CWE

NVD-CWE-Other

CAPEC

Access

Vector	Complexity	Authentication
NETWORK	LOW	NONE

Impact

Confidentiality	Integrity	Availability
PARTIAL	NONE	NONE

cvss-vector via4

AV:N/AC:L/Au:N/C:P/I:N/A:N

refmap via4

bugtraq	20061112 MyStats <=1.0.8 [injection sql, multiples xss, array & full path
sectrack	1017210
xf	mystats-mystats-path-disclosure(30213)

Last major update

29-07-2017 - 01:29

Published

10-12-2006 - 02:28

Last modified

29-07-2017 - 01:29