20060115 EZDatabase Directory Transversal, XSS and Path Disclosure Vulnerabilitymailing list
http://archives.neohapsis.com/archives/fulldisclosure/2006-01/0515.html CVE-2006-0315
EZDatabase 2.1.1 - 'index.php' Cross-Site Scripting
Record summary
CVE-2006-0315 has a selected CVSS score of 5.8; EIP currently links 1 catalogued exploit.
Description
index.php in EZDatabase before 2.1.2 does not properly cleanse the p parameter before constructing and including a .php filename, which allows remote attackers to conduct directory traversal attacks, and produces resultant cross-site scripting (XSS) and path disclosure.
Description source: CVE List
Exploitation context
Available material
- Catalogued exploits
- 1
Proofs of concept
1Catalogued exploits
ExploitDBEZDatabase 2.1.1 - 'index.php' Cross-Site ScriptingExploitDB exploitby Josh Zlatin-AmishavNot analyzed1 file
References
918043Third-party advisory
http://secunia.com/advisories/18043 22684vdb entry
http://www.osvdb.org/22684 20060115 EZDatabase Directory Transversal, XSS and Path Disclosure Vulnerabilitymailing list
http://www.securityfocus.com/archive/1/422071/100/0/threaded 16257vdb entry
http://www.securityfocus.com/bid/16257 zur.homelinux.com
http://zur.homelinux.com/Advisories/ezdatabase_dir_trans.txt ezdatabase-index-p-xss(24134)vdb entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/24134 ezdatabase-index-p-path-disclosure(24135)vdb entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/24135 nvd.nist.gov
https://nvd.nist.gov/vuln/detail/CVE-2006-0315