Vulnerability Details : CVE-2006-3554
Directory traversal vulnerability in index.php in MKPortal 1.0.1 Final allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the language cookie, as demonstrated by using a gl_session cookie to inject PHP sequences into the error.log file, which is then included by index.php with malicious commands accessible by the ind parameter.
Vulnerability category: Directory traversal
Exploit prediction scoring system (EPSS) score for CVE-2006-3554
Probability of exploitation activity in the next 30 days: 0.86%
Percentile, the proportion of vulnerabilities that are scored at or less: ~ 82 % EPSS Score History EPSS FAQ
CVSS scores for CVE-2006-3554
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source |
|---|---|---|---|---|---|
|
7.5
|
HIGH | AV:N/AC:L/Au:N/C:P/I:P/A:P |
10.0
|
6.4
|
NIST |
References for CVE-2006-3554
-
https://exchange.xforce.ibmcloud.com/vulnerabilities/27451
-
http://securityreason.com/securityalert/1234
-
http://www.vupen.com/english/advisories/2006/2598
-
http://securitytracker.com/id?1016403
Exploit
-
http://www.worlddefacers.de/Public/WD-MKP.txt
Exploit
-
http://www.securityfocus.com/bid/18707
-
http://www.securityfocus.com/archive/1/438614/100/100/threaded
Products affected by CVE-2006-3554
- cpe:2.3:a:mkportal:mkportal:1.0.1_final:*:*:*:*:*:*:*