CVE-2007-1906
First published: Tue Apr 10 2007(Updated: )
Directory traversal vulnerability in richedit/keyboard.php in eCardMAX HotEditor (Hot Editor) 4.0, and the HotEditor plugin for MyBB, allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the first parameter.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Ecardmax Hot Editor | =4.0 | |
| MyBB Hot Editor Plugin |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://www.expw0rm.com/hot-editor-v40-local-file-inclusion_no113.html
- http://www.expw0rm.com/mybb-hot-editor-plugin-local-file-inclusion_no114.html
- http://www.securityfocus.com/bid/23377
- http://secunia.com/advisories/24825
- http://securityreason.com/securityalert/2533
- http://osvdb.org/34776
- http://www.vupen.com/english/advisories/2007/1315
- https://exchange.xforce.ibmcloud.com/vulnerabilities/33521
- http://www.securityfocus.com/archive/1/465094/100/0/threaded
- http://www.securityfocus.com/archive/1/465092/100/0/threaded
Frequently Asked Questions
What is the severity of CVE-2007-1906?
CVE-2007-1906 is considered to be a high severity vulnerability due to its potential for remote code execution.
How does CVE-2007-1906 exploit directory traversal?
CVE-2007-1906 allows remote attackers to exploit directory traversal by using the .. (dot dot) sequence in the first parameter to include and execute arbitrary files.
What software is affected by CVE-2007-1906?
CVE-2007-1906 affects eCardMAX Hot Editor version 4.0 and the HotEditor plugin for MyBB.
How can I fix CVE-2007-1906?
To fix CVE-2007-1906, update to a patched version of eCardMAX Hot Editor or the MyBB Hot Editor plugin that addresses this vulnerability.
What are the potential impacts of CVE-2007-1906?
The potential impacts of CVE-2007-1906 include unauthorized access to sensitive files and execution of malicious code on the server.
- agent/references
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/author
- agent/last-modified-date
- agent/weakness
- agent/severity
- agent/description
- agent/first-publish-date
- agent/event
- agent/source
- agent/tags
- collector/nvd-historical
- agent/software-canonical-lookup-request
- collector/nvd-index
- vendor/ecardmax.com
- canonical/ecardmax hot editor
- version/ecardmax hot editor/4.0
- vendor/mybb
- canonical/mybb hot editor plugin