CVE-2006-5733

Postnuke < 0.763 - Path Traversal

Title source: rule

Description

Directory traversal vulnerability in error.php in PostNuke 0.763 and earlier allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the PNSVlang (PNSV lang) cookie, as demonstrated by injecting PHP sequences into an Apache HTTP Server log file, which is then included by error.php.

Exploits (1)

exploitdb WORKING POC VERIFIED

by Kacper · phpwebappsphp

https://www.exploit-db.com/exploits/2707

View Code ZIP pw:eip

References (6)

[Various Sources] http://community.postnuke.com/Article2787.htm

[Exploit] http://www.securityfocus.com/bid/20897

[Third Party Advisory, VDB Entry] http://www.securityfocus.com/bid/21218

[Third Party Advisory, VDB Entry] https://exchange.xforce.ibmcloud.com/vulnerabilities/29992

[Exploit, Third Party Advisory] https://www.exploit-db.com/exploits/2707

[Third Party Advisory] http://secunia.com/advisories/22983

Scores

EPSS 0.1116

EPSS Percentile 93.5%

Details

Status published

Products (2)

postnuke_software_foundation/postnuke 0.762

postnuke_software_foundation/postnuke < 0.763

Published Nov 06, 2006

Tracked Since Feb 18, 2026