CVE-2006-1480 : Directory traversal vulnerability in start.php in WebAlbum 2.02 allows remote attackers to include arbitrary files and e

Directory traversal vulnerability in start.php in WebAlbum 2.02 allows remote attackers to include arbitrary files and execute commands by (1) injecting code into local log files via GET commands, then (2) accessing that log via a .. (dot dot) sequence and a trailing null (%00) byte in the skin2 COOKIE parameter.

Published 2006-03-29 01:06:00

Updated 2017-10-19 01:29:04

Source MITRE

View at NVD, CVE.org

Vulnerability category: Directory traversal

Exploit prediction scoring system (EPSS) score for CVE-2006-1480

EPSS FAQ

2.20%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 88 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2006-1480

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source	First Seen
5.1	MEDIUM	AV:N/AC:H/Au:N/C:P/I:P/A:P	4.9	6.4	NIST
Access Vector: Network Access Complexity: High Authentication: None Confidentiality Impact: Partial Integrity Impact: Partial Availability Impact: Partial

Products affected by CVE-2006-1480

Duda » Webalbum
Versions up to, including, (<=) 2.02
cpe:2.3:a:duda:webalbum:*:*:*:*:*:*:*:*
Matching versions

Vulnerability Details : CVE-2006-1480

Exploit prediction scoring system (EPSS) score for CVE-2006-1480

CVSS scores for CVE-2006-1480

References for CVE-2006-1480

Products affected by CVE-2006-1480