~ / search / GHSA-2wxv-3g4v-p76p

GHSA-2wxv-3g4v-p76p

phpSysInfo allows remote attackers to determine the existence of arbitrary files via a .. (dot dot) sequence

Source: GitHub Advisory Database (reviewed) Moderate CVE-2006-3360

Packages

EcosystemPackageAffectedFixed in
Packagist phpsysinfo/phpsysinfo < 3.2.5 3.2.5

Details

As written in the advisory (Markdown source, shown as plain text).

Directory traversal vulnerability in index.php in phpSysInfo prior to 3.2.5 allows remote attackers to determine the existence of arbitrary files via a .. (dot dot) sequence and a trailing null (%00) byte in the lng parameter, which will display a different error message if the file exists.

References

External links from the advisory. They lead to third-party sites.