CVE-2006-7133 - Vulnerability Details - OpenCVE

Directory traversal vulnerability in upload/bin/download.php in Upload Tool for PHP 1.0 allows remote attackers to read arbitrary files via (1) ".." sequences or (2) absolute pathnames in the filename parameter.

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

Access Vector Network

Access Complexity Low

Authentication None

Confidentiality Impact Partial

Integrity Impact None

Availability Impact None

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Php Upload Tool	Php Upload Tool

Configuration 1 [-]

cpe:2.3:a:php_upload_tool:php_upload_tool:1.0:*:*:*:*:*:*:*

No data.

References

Link	Providers
http://secunia.com/advisories/22973
http://www.craigheffner.com/security/exploits/upload_tool_php.txt
http://www.securityfocus.com/bid/21150
http://www.vupen.com/english/advisories/2006/4575
https://exchange.xforce.ibmcloud.com/vulnerabilities/30322

History

No history.

MITRE

Status: PUBLISHED

Assigner: mitre

Published: 2007-03-06T01:00:00

Updated: 2024-08-07T20:50:06.129Z

Reserved: 2007-03-05T00:00:00

Link: CVE-2006-7133

Vulnrichment

No data.

NVD

Status : Deferred

Published: 2007-03-06T01:19:00.000

Modified: 2025-04-09T00:30:58.490

Link: CVE-2006-7133

Redhat

No data.

{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "datePublic": "2006-11-17T00:00:00", "descriptions": [{"lang": "en", "value": "Directory traversal vulnerability in upload/bin/download.php in Upload Tool for PHP 1.0 allows remote attackers to read arbitrary files via (1) \"..\" sequences or (2) absolute pathnames in the filename parameter."}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2017-07-28T12:57:01", "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre"}, "references": [{"tags": ["x_refsource_MISC"], "url": "http://www.craigheffner.com/security/exploits/upload_tool_php.txt"}, {"name": "22973", "tags": ["third-party-advisory", "x_refsource_SECUNIA"], "url": "http://secunia.com/advisories/22973"}, {"name": "utp-download-information-disclosure(30322)", "tags": ["vdb-entry", "x_refsource_XF"], "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/30322"}, {"name": "21150", "tags": ["vdb-entry", "x_refsource_BID"], "url": "http://www.securityfocus.com/bid/21150"}, {"name": "ADV-2006-4575", "tags": ["vdb-entry", "x_refsource_VUPEN"], "url": "http://www.vupen.com/english/advisories/2006/4575"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "[email protected]", "ID": "CVE-2006-7133", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "Directory traversal vulnerability in upload/bin/download.php in Upload Tool for PHP 1.0 allows remote attackers to read arbitrary files via (1) \"..\" sequences or (2) absolute pathnames in the filename parameter."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "http://www.craigheffner.com/security/exploits/upload_tool_php.txt", "refsource": "MISC", "url": "http://www.craigheffner.com/security/exploits/upload_tool_php.txt"}, {"name": "22973", "refsource": "SECUNIA", "url": "http://secunia.com/advisories/22973"}, {"name": "utp-download-information-disclosure(30322)", "refsource": "XF", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/30322"}, {"name": "21150", "refsource": "BID", "url": "http://www.securityfocus.com/bid/21150"}, {"name": "ADV-2006-4575", "refsource": "VUPEN", "url": "http://www.vupen.com/english/advisories/2006/4575"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-07T20:50:06.129Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_MISC", "x_transferred"], "url": "http://www.craigheffner.com/security/exploits/upload_tool_php.txt"}, {"name": "22973", "tags": ["third-party-advisory", "x_refsource_SECUNIA", "x_transferred"], "url": "http://secunia.com/advisories/22973"}, {"name": "utp-download-information-disclosure(30322)", "tags": ["vdb-entry", "x_refsource_XF", "x_transferred"], "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/30322"}, {"name": "21150", "tags": ["vdb-entry", "x_refsource_BID", "x_transferred"], "url": "http://www.securityfocus.com/bid/21150"}, {"name": "ADV-2006-4575", "tags": ["vdb-entry", "x_refsource_VUPEN", "x_transferred"], "url": "http://www.vupen.com/english/advisories/2006/4575"}]}]}, "cveMetadata": {"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "cveId": "CVE-2006-7133", "datePublished": "2007-03-06T01:00:00", "dateReserved": "2007-03-05T00:00:00", "dateUpdated": "2024-08-07T20:50:06.129Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:php_upload_tool:php_upload_tool:1.0:*:*:*:*:*:*:*", "matchCriteriaId": "EE9C582C-4789-4486-9B47-57F3D695CD61", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Directory traversal vulnerability in upload/bin/download.php in Upload Tool for PHP 1.0 allows remote attackers to read arbitrary files via (1) \"..\" sequences or (2) absolute pathnames in the filename parameter."}, {"lang": "es", "value": "Vulnerabilidad de salto de directorio en upload/bind/download.php de Upload Tool for PHP 1.0 permite a atacantes remotos leer archivos de su elecci\u00f3n mediante (1) secuencias .. (punto punto) o (2) nombres de ruta absolutos en el par\u00e1metro filename."}], "id": "CVE-2006-7133", "lastModified": "2025-04-09T00:30:58.490", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 5.0, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "[email protected]", "type": "Primary", "userInteractionRequired": false}]}, "published": "2007-03-06T01:19:00.000", "references": [{"source": "[email protected]", "url": "http://secunia.com/advisories/22973"}, {"source": "[email protected]", "tags": ["Exploit", "URL Repurposed"], "url": "http://www.craigheffner.com/security/exploits/upload_tool_php.txt"}, {"source": "[email protected]", "url": "http://www.securityfocus.com/bid/21150"}, {"source": "[email protected]", "url": "http://www.vupen.com/english/advisories/2006/4575"}, {"source": "[email protected]", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/30322"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://secunia.com/advisories/22973"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit", "URL Repurposed"], "url": "http://www.craigheffner.com/security/exploits/upload_tool_php.txt"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.securityfocus.com/bid/21150"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.vupen.com/english/advisories/2006/4575"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/30322"}], "sourceIdentifier": "[email protected]", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-Other"}], "source": "[email protected]", "type": "Primary"}]}