CVE-2006-0625: Code Injection
Directory traversal vulnerability in SpipRSS.PHP in SPIP 1.8.2g and earlier allows remote attackers to read or include arbitrary files via ".." sequences in the GLOBALS[typeurls] parameter, which could then be used to execute arbitrary code via resultant direct static code injection in the file parameter to spipaccesdoc.php3.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2006-0625?
CVE-2006-0625 is classified as a medium severity vulnerability due to its potential for remote code execution.
How does CVE-2006-0625 exploit directory traversal?
CVE-2006-0625 exploits directory traversal by allowing attackers to manipulate the GLOBALS[type_urls] parameter using ".." sequences to access arbitrary files.
Which SPIP versions are affected by CVE-2006-0625?
CVE-2006-0625 affects SPIP versions 1.8.2d, 1.8.2e, and 1.8.2g.
How do I fix CVE-2006-0625?
To fix CVE-2006-0625, upgrade to a version of SPIP that addresses this directory traversal vulnerability, beyond 1.8.2g.
What are the potential impacts of CVE-2006-0625?
The potential impacts of CVE-2006-0625 include unauthorized access to sensitive files and the possibility of executing arbitrary code on the server.