CVE-2006-3091 - Vulnerability Details - OpenCVE

PhpMyFactures 1.0, and possibly 1.2 and earlier, allows remote attackers to obtain the installation path via a direct request to (1) /verif.php, (2) /inc/footer.php, and (3) /remises/ajouter_remise.php.

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

Access Vector Network

Access Complexity Low

Authentication None

Confidentiality Impact Partial

Integrity Impact None

Availability Impact None

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Phpmyfactures	Phpmyfactures

Configuration 1 [-]

OR	cpe:2.3:a:phpmyfactures:phpmyfactures::::::::
	cpe:2.3:a:phpmyfactures:phpmyfactures:1.0:::::::*

No data.

References

Link	Providers
http://secunia.com/advisories/20642
http://securityreason.com/securityalert/1111
http://www.acid-root.new.fr/advisories/phpmyfactures.txt
http://www.osvdb.org/26486
http://www.osvdb.org/26487
http://www.osvdb.org/26488
http://www.securityfocus.com/archive/1/437025/100/0/threaded
https://exchange.xforce.ibmcloud.com/vulnerabilities/27205

History

No history.

MITRE

Status: PUBLISHED

Assigner: mitre

Published: 2006-06-19T21:00:00

Updated: 2024-08-07T18:16:05.485Z

Reserved: 2006-06-19T00:00:00

Link: CVE-2006-3091

Vulnrichment

No data.

NVD

Status : Deferred

Published: 2006-06-19T21:02:00.000

Modified: 2025-04-03T01:03:51.193

Link: CVE-2006-3091

Redhat

No data.

{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "datePublic": "2006-06-10T00:00:00", "descriptions": [{"lang": "en", "value": "PhpMyFactures 1.0, and possibly 1.2 and earlier, allows remote attackers to obtain the installation path via a direct request to (1) /verif.php, (2) /inc/footer.php, and (3) /remises/ajouter_remise.php."}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2018-10-18T14:57:01", "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre"}, "references": [{"name": "26488", "tags": ["vdb-entry", "x_refsource_OSVDB"], "url": "http://www.osvdb.org/26488"}, {"name": "20060610 PhpMyFactures 1.0 Cross Site Scripting, SQL Injection, Full Path Disclosure and others", "tags": ["mailing-list", "x_refsource_BUGTRAQ"], "url": "http://www.securityfocus.com/archive/1/437025/100/0/threaded"}, {"name": "phpmyfactures-multi-scripts-path-disclosure(27205)", "tags": ["vdb-entry", "x_refsource_XF"], "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/27205"}, {"name": "26487", "tags": ["vdb-entry", "x_refsource_OSVDB"], "url": "http://www.osvdb.org/26487"}, {"name": "20642", "tags": ["third-party-advisory", "x_refsource_SECUNIA"], "url": "http://secunia.com/advisories/20642"}, {"tags": ["x_refsource_MISC"], "url": "http://www.acid-root.new.fr/advisories/phpmyfactures.txt"}, {"name": "26486", "tags": ["vdb-entry", "x_refsource_OSVDB"], "url": "http://www.osvdb.org/26486"}, {"name": "1111", "tags": ["third-party-advisory", "x_refsource_SREASON"], "url": "http://securityreason.com/securityalert/1111"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "cve@mitre.org", "ID": "CVE-2006-3091", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "PhpMyFactures 1.0, and possibly 1.2 and earlier, allows remote attackers to obtain the installation path via a direct request to (1) /verif.php, (2) /inc/footer.php, and (3) /remises/ajouter_remise.php."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "26488", "refsource": "OSVDB", "url": "http://www.osvdb.org/26488"}, {"name": "20060610 PhpMyFactures 1.0 Cross Site Scripting, SQL Injection, Full Path Disclosure and others", "refsource": "BUGTRAQ", "url": "http://www.securityfocus.com/archive/1/437025/100/0/threaded"}, {"name": "phpmyfactures-multi-scripts-path-disclosure(27205)", "refsource": "XF", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/27205"}, {"name": "26487", "refsource": "OSVDB", "url": "http://www.osvdb.org/26487"}, {"name": "20642", "refsource": "SECUNIA", "url": "http://secunia.com/advisories/20642"}, {"name": "http://www.acid-root.new.fr/advisories/phpmyfactures.txt", "refsource": "MISC", "url": "http://www.acid-root.new.fr/advisories/phpmyfactures.txt"}, {"name": "26486", "refsource": "OSVDB", "url": "http://www.osvdb.org/26486"}, {"name": "1111", "refsource": "SREASON", "url": "http://securityreason.com/securityalert/1111"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-07T18:16:05.485Z"}, "title": "CVE Program Container", "references": [{"name": "26488", "tags": ["vdb-entry", "x_refsource_OSVDB", "x_transferred"], "url": "http://www.osvdb.org/26488"}, {"name": "20060610 PhpMyFactures 1.0 Cross Site Scripting, SQL Injection, Full Path Disclosure and others", "tags": ["mailing-list", "x_refsource_BUGTRAQ", "x_transferred"], "url": "http://www.securityfocus.com/archive/1/437025/100/0/threaded"}, {"name": "phpmyfactures-multi-scripts-path-disclosure(27205)", "tags": ["vdb-entry", "x_refsource_XF", "x_transferred"], "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/27205"}, {"name": "26487", "tags": ["vdb-entry", "x_refsource_OSVDB", "x_transferred"], "url": "http://www.osvdb.org/26487"}, {"name": "20642", "tags": ["third-party-advisory", "x_refsource_SECUNIA", "x_transferred"], "url": "http://secunia.com/advisories/20642"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "http://www.acid-root.new.fr/advisories/phpmyfactures.txt"}, {"name": "26486", "tags": ["vdb-entry", "x_refsource_OSVDB", "x_transferred"], "url": "http://www.osvdb.org/26486"}, {"name": "1111", "tags": ["third-party-advisory", "x_refsource_SREASON", "x_transferred"], "url": "http://securityreason.com/securityalert/1111"}]}]}, "cveMetadata": {"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "cveId": "CVE-2006-3091", "datePublished": "2006-06-19T21:00:00", "dateReserved": "2006-06-19T00:00:00", "dateUpdated": "2024-08-07T18:16:05.485Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:phpmyfactures:phpmyfactures:*:*:*:*:*:*:*:*", "matchCriteriaId": "CA2ECFEC-07D0-47A2-8181-60F6A28F9D53", "versionEndIncluding": "1.2", "vulnerable": true}, {"criteria": "cpe:2.3:a:phpmyfactures:phpmyfactures:1.0:*:*:*:*:*:*:*", "matchCriteriaId": "33B85248-B9C6-4C0D-BB7B-0453C24B3F0E", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "PhpMyFactures 1.0, and possibly 1.2 and earlier, allows remote attackers to obtain the installation path via a direct request to (1) /verif.php, (2) /inc/footer.php, and (3) /remises/ajouter_remise.php."}, {"lang": "es", "value": "PhpMyFactures v1.0, y posiblemente v1.2 y anteriores, permite a atacantes remotos obtener la ruta de instalaci\u00f3n a trav\u00e9s de una petici\u00f3n directa a (1) / verif.php, (2) / inc / footer.php, y (3) / remises / ajouter_remise.php ."}], "id": "CVE-2006-3091", "lastModified": "2025-04-03T01:03:51.193", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 5.0, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}]}, "published": "2006-06-19T21:02:00.000", "references": [{"source": "cve@mitre.org", "url": "http://secunia.com/advisories/20642"}, {"source": "cve@mitre.org", "url": "http://securityreason.com/securityalert/1111"}, {"source": "cve@mitre.org", "tags": ["Exploit", "Vendor Advisory"], "url": "http://www.acid-root.new.fr/advisories/phpmyfactures.txt"}, {"source": "cve@mitre.org", "url": "http://www.osvdb.org/26486"}, {"source": "cve@mitre.org", "url": "http://www.osvdb.org/26487"}, {"source": "cve@mitre.org", "url": "http://www.osvdb.org/26488"}, {"source": "cve@mitre.org", "url": "http://www.securityfocus.com/archive/1/437025/100/0/threaded"}, {"source": "cve@mitre.org", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/27205"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://secunia.com/advisories/20642"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://securityreason.com/securityalert/1111"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit", "Vendor Advisory"], "url": "http://www.acid-root.new.fr/advisories/phpmyfactures.txt"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.osvdb.org/26486"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.osvdb.org/26487"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.osvdb.org/26488"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.securityfocus.com/archive/1/437025/100/0/threaded"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/27205"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-Other"}], "source": "nvd@nist.gov", "type": "Primary"}]}