CVEvulnerability

CVE-2006-2331

6.4 MEDIUM Published 2006-05-12 Modified 2026-06-16 Official page ↗
Status
Modified
Published
2006-05-12
Last modified
2026-06-16
Assigner
[email protected]
CVSS 2.0 ([email protected])
6.4 MEDIUM — AV:N/AC:L/Au:N/C:P/I:P/A:N

Description

Multiple directory traversal vulnerabilities in PHP-Fusion 6.00.306 allow remote attackers to include and execute arbitrary local files via (1) a .. (dot dot) in the settings[locale] parameter in infusions/last_seen_users_panel/last_seen_users_panel.php, and (2) a .. (dot dot) in the localeset parameter in setup.php. NOTE: the vendor states that this issue might exist due to problems in third party local files.

Affected configurations

• php fusion php fusion 6.00.3 • php fusion php fusion 6.00.105 • php fusion php fusion 6.00.106 • php fusion php fusion 6.00.107 • php fusion php fusion 6.00.109 • php fusion php fusion 6.00.110 • php fusion php fusion 6.00.204 • php fusion php fusion 6.00.206 • php fusion php fusion 6.00.303 • php fusion php fusion 6.00.304 • php fusion php fusion 6.00.306

References