CVE-2006-6690

Typo3 <4.0.3, 3.7, 3.8, 4.1 beta - Authenticated Command Injection

Title source: llm
STIX 2.1

Description

rtehtmlarea/pi1/class.tx_rtehtmlarea_pi1.php in Typo3 4.0.0 through 4.0.3, 3.7 and 3.8 with the rtehtmlarea extension, and 4.1 beta allows remote authenticated users to execute arbitrary commands via shell metacharacters in the userUid parameter to rtehtmlarea/htmlarea/plugins/SpellChecker/spell-check-logic.php, and possibly another vector.

Exploits (1)

exploitdb WORKING POC VERIFIED
by D. Fabian · textwebappsphp
https://www.exploit-db.com/exploits/29300

References (11)

Core 11
Core References
Third Party Advisory, VDB Entry mailing-list x_refsource_bugtraq
http://www.securityfocus.com/archive/1/454944/100/0/threaded
Patch, Vendor Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/23466
Exploit x_refsource_misc
http://www.sec-consult.com/272.html
Vendor Advisory mailing-list x_refsource_mlist
http://lists.netfielders.de/pipermail/typo3-announce/2006/000045.html
Exploit, Patch vdb-entry x_refsource_sectrack
http://securitytracker.com/id?1017428
Third Party Advisory third-party-advisory x_refsource_sreason
http://securityreason.com/securityalert/2056
Vendor Advisory mailing-list x_refsource_mlist
http://lists.netfielders.de/pipermail/typo3-announce/2006/000046.html
Patch, Vendor Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/23446
Third Party Advisory vdb-entry x_refsource_vupen
http://www.vupen.com/english/advisories/2006/5094
Exploit, Patch vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/21680

Scores

EPSS 0.2104
EPSS Percentile 95.7%

Details

Status published
Products (6)
typo3/typo3 3.7.0
typo3/typo3 3.8
typo3/typo3 4.0
typo3/typo3 4.0.1
typo3/typo3 4.0.2
typo3/typo3 4.0.3
Published Dec 21, 2006
Tracked Since Feb 18, 2026