GitHub Advisoryadvisory · Packagist

GHSA-2wxv-3g4v-p76p phpSysInfo allows remote attackers to determine the existence of arbitrary files via a .. (dot dot) sequence

MEDIUM Published 2022-05-01 Modified 2023-03-30 Official page ↗
Aliases
CVE-2006-3360
Ecosystem
Packagist
Packages
phpsysinfo/phpsysinfo
Severity
Moderate
Weaknesses
CWE-22
Reviewed
2023-03-30

Affected packages

• Packagist phpsysinfo/phpsysinfo: < 3.2.5 → fixed in 3.2.5

Description

Directory traversal vulnerability in index.php in phpSysInfo prior to 3.2.5 allows remote attackers to determine the existence of arbitrary files via a .. (dot dot) sequence and a trailing null (%00) byte in the lng parameter, which will display a different error message if the file exists.

Related

Alias · CVE (1)

  • CVE-2006-3360 Directory traversal vulnerability in index.php in phpSysInfo 2.5.1 allows remote attackers to determine the existence of arbitrary files… vulnerability

Weakness · CWE (1)

  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness

References