Lumension® Endpoint Intelligence Center

Intelligence Center » Browse All Vulnerabilities » CVE-2006-3128

Overview

Vulnerability Score 4.6 4.6
CVE Id CVE-2006-3128
Last Modified 07 Mar 2011 09:37:55
Published 21 Jun 2006 07:02:00
Confidentiality Impact PARTIAL PARTIAL
Integrity Impact PARTIAL PARTIAL
Availability Impact PARTIAL PARTIAL
Access Vector NETWORK
Access Complexity HIGH
Authentication SINGLE_INSTANCE

CVE-2006-3128

Summary

choose_file.php in easy-CMS 0.1.2, when mod_mime is installed, does not restrict uploads of filenames with multiple extensions, which allows remote attackers to execute arbitrary PHP code by uploading a PHP file with a GIF file extension, then directly accessing that file in the Repositories directory.

Vulnerable Systems

Application

  • Easy-cms 0.1.2


References

VUPEN - ADV-2006-2419

SECTRACK - 1016335

SECUNIA - 20733

MISC - http://biyosecurity.be/bugs/easycms.txt

XF - easycms-extensions-file-upload(27281)

BID - 18496

BUGTRAQ - 20060618 Easy CMS 0.1.2 Php Shell Upload Vulnerabilities

OSVDB - 26633


Last Updated: 27 May 2016 10:42:54