CVE-2006-4004

Published: Aug 7, 2006Modified: Apr 16, 2026

6.4

Vector

AV:N/AC:L/Au:N/C:P/I:P/A:N

Exploitability: 10.0 / Impact: 4.9

Source: NVD

Description

Directory traversal vulnerability in index.php in vbPortal 3.0.2 through 3.6.0 Beta 1, when magic_quotes_gpc is disabled, allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the bbvbplang cookie, as demonstrated by injecting PHP sequences into an Apache HTTP Server log file, which is then included by index.php.

Affected (5)

Products: Vbportal: Vbportal

1 product

Configuration A

5 vulnerable

Vulnerable Software	Affected Versions
Vbportal Vbportal	Version 3.0.2
Vbportal Vbportal	Version 3.5.0_beta_2
Vbportal Vbportal	Version 3.5.0_beta_3
Vbportal Vbportal	Version 3.5.0_gold
Vbportal Vbportal	Version 3.6.0_beta_1

References (12)

http://secunia.com/advisories/21287

Source: cve@mitre.org

ExploitVendor Advisory

http://www.phpportals.com/forums/showthread.php?t=17308

Source: cve@mitre.org

http://www.securityfocus.com/bid/19257

Source: cve@mitre.org

Exploit

http://www.vupen.com/english/advisories/2006/3102

Source: cve@mitre.org

https://exchange.xforce.ibmcloud.com/vulnerabilities/28077

Source: cve@mitre.org

https://www.exploit-db.com/exploits/2087

Source: cve@mitre.org

http://secunia.com/advisories/21287

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitVendor Advisory

http://www.phpportals.com/forums/showthread.php?t=17308

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.securityfocus.com/bid/19257

Source: af854a3a-2127-422b-91ae-364da2661108

Exploit

http://www.vupen.com/english/advisories/2006/3102

Source: af854a3a-2127-422b-91ae-364da2661108

https://exchange.xforce.ibmcloud.com/vulnerabilities/28077

Source: af854a3a-2127-422b-91ae-364da2661108

https://www.exploit-db.com/exploits/2087

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.