vulnwire
7.5high

CVE-2006-08991 exploit

Directory traversal vulnerability in index.php in 4Images 1.7.1 and earlier allows remote attackers to read and include arbitrary files via…

Published 20 y ago · modified 4 mo ago · JSON

CVSS
7.5
v2.0 · NVD
CISA KEV
No
not known exploited
EPSS
10.0%
percentile 96%
Public exploits
1
Exploit-DB

Directory traversal vulnerability in index.php in 4Images 1.7.1 and earlier allows remote attackers to read and include arbitrary files via ".." (dot dot) sequences in the template parameter.

Exploit prediction (EPSS)

9.98% probability of exploitation in the next 30 days, higher than 96% of all scored CVEs.

Exploits and detections

  • EDB-1533 4Images 1.7.1 - Local File Inclusion / Remote Code Execution · webapps · 2006-02-26

CVSS scores

Assigned byVersionScoreVector
NVD2.07.5AV:N/AC:L/Au:N/C:P/I:P/A:P

References

  • secunia.com /advisories/19026 · third-party-advisory, x_refsource_SECUNIA, x_transferred
  • exchange.xforce.ibmcloud.com /vulnerabilities/24938 · vdb-entry, x_refsource_XF, x_transferred
  • exploit-db.com /exploits/1533 · exploit, x_refsource_EXPLOIT-DB, x_transferred
  • securityreason.com /securityalert/518 · third-party-advisory, x_refsource_SREASON, x_transferred
  • retrogod.altervista.org /4images_171_adv.html · x_refsource_MISC, x_transferred
  • securityfocus.com /archive/1/426468/100/0/threaded · mailing-list, x_refsource_BUGTRAQ, x_transferred
  • osvdb.org /23529 · vdb-entry, x_refsource_OSVDB, x_transferred
  • vupen.com /english/advisories/2006/0754 · vdb-entry, x_refsource_VUPEN, x_transferred
  • securityfocus.com /bid/16855 · vdb-entry, x_refsource_BID, x_transferred

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.