CVE-2006-1339

Directory traversal vulnerability in inc/functions.inc.php in CuteNews 1.4.1 and possibly other versions, when register_globals is enabled, allows remote…

published March 21, 2006

CVSS
—
EPSS
2%
Percentile
75.9
In the wild
Unconfirmed
What it is

Directory traversal vulnerability in inc/functions.inc.php in CuteNews 1.4.1 and possibly other versions, when register_globals is enabled, allows remote attackers to include arbitrary files via a .. (dot dot) sequence and trailing NULL (%00) byte in the archive parameter in an HTTP POST or COOKIE request, which bypasses a sanity check that is only applied to a GET request.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.01624 · 75.9th percentile
Published
2006-03-21T02:00Z
EPSS history
Timeline
  • 21 MAR 02:00Z
    Directory traversal vulnerability in inc/functions.inc.php in CuteNews 1.4.1 and possibly other versions, when register_globals is enabled, allows remote…
    cvelistv5