vulnwire
5.0med

CVE-2006-08911 exploit

Multiple directory traversal vulnerabilities in NOCC Webmail 1.0 allow remote attackers to include arbitrary files via .. (dot dot) sequenc…

Published 20 y ago · modified 4 mo ago · JSON

CVSS
5.0
v2.0 · NVD
CISA KEV
No
not known exploited
EPSS
8.5%
percentile 95%
Public exploits
1
Exploit-DB

Multiple directory traversal vulnerabilities in NOCC Webmail 1.0 allow remote attackers to include arbitrary files via .. (dot dot) sequences and a trailing NULL (%00) byte in (1) the _SESSION['nocc_theme'] parameter in (a) html/footer.php; and (2) the lang and (3) theme parameters and the (4) Accept-Language HTTP header field, when force_default_lang is disabled, in (b) index.php, as demonstrated by injecting PHP code into a profile and accessing it using the lang parameter in index.php.

Exploit prediction (EPSS)

8.49% probability of exploitation in the next 30 days, higher than 95% of all scored CVEs.

Exploits and detections

  • EDB-1522 NOCC Webmail 1.0 - Local File Inclusion / Remote Code Execution · webapps · 2006-02-23

CVSS scores

Assigned byVersionScoreVector
NVD2.05.0AV:N/AC:L/Au:N/C:N/I:P/A:N

References

  • securitytracker.com /id?1015671 · vdb-entry, x_refsource_SECTRACK, x_transferred
  • exchange.xforce.ibmcloud.com /vulnerabilities/24934 · vdb-entry, x_refsource_XF, x_transferred
  • osvdb.org /23416 · vdb-entry, x_refsource_OSVDB, x_transferred
  • archives.neohapsis.com /archives/bugtraq/2006-02/0418.html · mailing-list, x_refsource_BUGTRAQ, x_transferred
  • osvdb.org /23417 · vdb-entry, x_refsource_OSVDB, x_transferred
  • secunia.com /advisories/16921 · third-party-advisory, x_refsource_SECUNIA, x_transferred
  • retrogod.altervista.org /noccw_10_incl_xpl.html · x_refsource_MISC, x_transferred
  • securityfocus.com /bid/16793 · vdb-entry, x_refsource_BID, x_transferred
  • osvdb.org /23418 · vdb-entry, x_refsource_OSVDB, x_transferred
  • osvdb.org /23419 · vdb-entry, x_refsource_OSVDB, x_transferred

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.