CVE-2006-0869

Public exploit code

Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.

• PEAR LiveUser < 0.16.8 - Arbitrary File Access2016-02-21 · webapps · php

Impact

Directory traversal vulnerability in the "remember me" feature in liveuser.php in PHP Extension and Application Repository (PEAR) LiveUser 0.16.8 and earlier allows remote attackers to determine file existence, and possibly delete arbitrary files with short pathnames or possibly read arbitrary files, via a .. (dot dot) in the store_id value of a cookie.

Affected products

References

• NVD record
• CVE.org record
• http://pear.php.net/package/LiveUser/download/
• http://securityreason.com/securityalert/466
• http://securitytracker.com/id?1015659
• http://www.gulftech.org/?node=research&article_id=00103-02212006
• http://www.securityfocus.com/archive/1/425711/100/0/threaded
• http://www.securityfocus.com/bid/16761
• http://www.vupen.com/english/advisories/2006/0697
• https://exchange.xforce.ibmcloud.com/vulnerabilities/24852
• https://exchange.xforce.ibmcloud.com/vulnerabilities/24853
• http://pear.php.net/package/LiveUser/download/
• http://securityreason.com/securityalert/466
• http://securitytracker.com/id?1015659
• http://www.gulftech.org/?node=research&article_id=00103-02212006
• http://www.securityfocus.com/archive/1/425711/100/0/threaded
• http://www.securityfocus.com/bid/16761
• http://www.vupen.com/english/advisories/2006/0697
• https://exchange.xforce.ibmcloud.com/vulnerabilities/24852
• https://exchange.xforce.ibmcloud.com/vulnerabilities/24853