CVE-2006-0713 - CVE House
Back to Database
Status published Medium CVE-2006-0713

Directory traversal vulnerability in LinPHA 1.0 allows remote attackers to...

Vulnerability Description

Directory traversal vulnerability in LinPHA 1.0 allows remote attackers to include arbitrary files via .. (dot dot) sequences in the (1) lang parameter in docs/index.php and the language parameter in (2) install/install.php, (3) install/sec_stage_install.php, (4) install/third_stage_install.php, and (5) install/forth_stage_install.php. NOTE: direct static code injection is resultant from this issue, as demonstrated by inserting PHP code into the username, which is inserted into linpha.log, which is accessible from the directory traversal.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2006-0713

Credits & Attribution

No credits recorded in the NVD database.

References

More from linpha

View All →
CVE-2014-7265
Cross-site scripting (XSS) vulnerability in LinPHA allows remote attackers to...
Medium 4.3
CVE-2011-3753
LinPHA 1.3.4 allows remote attackers to obtain sensitive information via...
Medium 5
CVE-2008-7223
Multiple cross-site scripting (XSS) vulnerabilities in LinPHA before 1.3.3 allow...
Medium 4.3
CVE-2008-6571
Multiple cross-site scripting (XSS) vulnerabilities in LinPHA before 1.3.4 might...
Medium 4.3
CVE-2008-1856
plugins/maps/db_handler.php in LinPHA 1.3.3 and earlier does not require authentication...
Medium 5.1

Affected Vendor

Affected Software

linpha
Vulnerable Versions:
0.9.0, 0.9.1, 0.9.2, 0.9.3, 0.9.4, 1.0

Timeline

Official Publish: February 15th, 2006
Last Modified: August 7th, 2024
Added to House: July 18th, 2026

CVSS Vectors

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.