CVE-2006-6112 - CVE House
Back to Database
Status published Medium CVE-2006-6112

LifeType 1.0.x and 1.1.x have insufficient access control for all...

Vulnerability Description

LifeType 1.0.x and 1.1.x have insufficient access control for all of the PHP scripts under (1) class/ and (2) plugins/, which allows remote attackers to obtain the installation path via a direct request to any of the scripts, as demonstrated by (a) bayesianfilter.class.php and (b) bootstrap.php, which leaks the path in an error message.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2006-6112

Credits & Attribution

No credits recorded in the NVD database.

References

More from lifetype

View All →
CVE-2011-3751
LifeType 1.2.10 allows remote attackers to obtain sensitive information via...
Medium 5
CVE-2008-2629
SQL injection vulnerability in the LifeType (formerly pLog) module for...
High 7.5
CVE-2008-2196
Cross-site scripting (XSS) vulnerability in admin.php in LifeType 1.2.8 allows...
Medium 4.3
CVE-2008-2178
Cross-site scripting (XSS) vulnerability in admin.php in LifeType 1.2.7 allows...
Medium 4.3
CVE-2007-0979
Unspecified vulnerability in LifeType before 1.1.6, and 1.2 before 1.2-beta2,...
Medium 5

Affected Vendor

Affected Software

lifetype
Vulnerable Versions:
1.0.2, 1.0.3, 1.0.4, 1.0.5, 1.1.0, 1.1.1, 1.1.2

Timeline

Official Publish: December 6th, 2006
Last Modified: August 7th, 2024
Added to House: July 18th, 2026

CVSS Vectors

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.