CVE-2006-3365 - Vulnerability Details - OpenCVE

V3 Chat allows remote attackers to obtain the installation path via (1) an invalid id parameter to mail/index.php or (2) membername parameter to messenger/online.php, which displays the path in an error page due to an incorrect SQL statement.

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

Access Vector Network

Access Complexity High

Authentication None

Confidentiality Impact Partial

Integrity Impact None

Availability Impact None

This CVE is not in the KEV list.

The EPSS score is 0.00704.

Key SSVC decision points have not yet been added.

Vendors	Products
V3 Chat	V3 Chat

Configuration 1 [-]

cpe:2.3:a:v3_chat:v3_chat:beta:*:*:*:*:*:*:*

No data.

No data.

Advisories

Source	ID	Title
EUVD	EUVD-2006-3361	V3 Chat allows remote attackers to obtain the installation path via (1) an invalid id parameter to mail/index.php or (2) membername parameter to messenger/online.php, which displays the path in an error page due to an incorrect SQL statement.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References

Link	Providers
http://securitytracker.com/id?1016340
http://www.securityfocus.com/archive/1/437755/100/200/threaded
http://www.securityfocus.com/archive/1/438069/100/200/threaded
http://www.securityfocus.com/bid/18543
http://www.vupen.com/english/advisories/2006/2474
https://exchange.xforce.ibmcloud.com/vulnerabilities/27395

History

No history.

MITRE

Status: PUBLISHED

Assigner: mitre

Published: 2006-07-06T20:00:00

Updated: 2024-08-07T18:23:21.280Z

Reserved: 2006-07-06T00:00:00

Link: CVE-2006-3365

Vulnrichment

No data.

NVD

Status : Deferred

Published: 2006-07-06T20:05:00.000

Modified: 2025-04-03T01:03:51.193

Link: CVE-2006-3365

Redhat

No data.

OpenCVE Enrichment

No data.

{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "datePublic": "2006-06-17T00:00:00", "descriptions": [{"lang": "en", "value": "V3 Chat allows remote attackers to obtain the installation path via (1) an invalid id parameter to mail/index.php or (2) membername parameter to messenger/online.php, which displays the path in an error page due to an incorrect SQL statement."}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2018-10-18T14:57:01", "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre"}, "references": [{"name": "v3chat-index-path-disclosure(27395)", "tags": ["vdb-entry", "x_refsource_XF"], "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/27395"}, {"name": "18543", "tags": ["vdb-entry", "x_refsource_BID"], "url": "http://www.securityfocus.com/bid/18543"}, {"name": "1016340", "tags": ["vdb-entry", "x_refsource_SECTRACK"], "url": "http://securitytracker.com/id?1016340"}, {"name": "20060617 V3Chat Instant Messenger - XSS", "tags": ["mailing-list", "x_refsource_BUGTRAQ"], "url": "http://www.securityfocus.com/archive/1/437755/100/200/threaded"}, {"name": "ADV-2006-2474", "tags": ["vdb-entry", "x_refsource_VUPEN"], "url": "http://www.vupen.com/english/advisories/2006/2474"}, {"name": "20060622 Re: V3Chat Instant Messenger - XSS", "tags": ["mailing-list", "x_refsource_BUGTRAQ"], "url": "http://www.securityfocus.com/archive/1/438069/100/200/threaded"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "cve@mitre.org", "ID": "CVE-2006-3365", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "V3 Chat allows remote attackers to obtain the installation path via (1) an invalid id parameter to mail/index.php or (2) membername parameter to messenger/online.php, which displays the path in an error page due to an incorrect SQL statement."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "v3chat-index-path-disclosure(27395)", "refsource": "XF", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/27395"}, {"name": "18543", "refsource": "BID", "url": "http://www.securityfocus.com/bid/18543"}, {"name": "1016340", "refsource": "SECTRACK", "url": "http://securitytracker.com/id?1016340"}, {"name": "20060617 V3Chat Instant Messenger - XSS", "refsource": "BUGTRAQ", "url": "http://www.securityfocus.com/archive/1/437755/100/200/threaded"}, {"name": "ADV-2006-2474", "refsource": "VUPEN", "url": "http://www.vupen.com/english/advisories/2006/2474"}, {"name": "20060622 Re: V3Chat Instant Messenger - XSS", "refsource": "BUGTRAQ", "url": "http://www.securityfocus.com/archive/1/438069/100/200/threaded"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-07T18:23:21.280Z"}, "title": "CVE Program Container", "references": [{"name": "v3chat-index-path-disclosure(27395)", "tags": ["vdb-entry", "x_refsource_XF", "x_transferred"], "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/27395"}, {"name": "18543", "tags": ["vdb-entry", "x_refsource_BID", "x_transferred"], "url": "http://www.securityfocus.com/bid/18543"}, {"name": "1016340", "tags": ["vdb-entry", "x_refsource_SECTRACK", "x_transferred"], "url": "http://securitytracker.com/id?1016340"}, {"name": "20060617 V3Chat Instant Messenger - XSS", "tags": ["mailing-list", "x_refsource_BUGTRAQ", "x_transferred"], "url": "http://www.securityfocus.com/archive/1/437755/100/200/threaded"}, {"name": "ADV-2006-2474", "tags": ["vdb-entry", "x_refsource_VUPEN", "x_transferred"], "url": "http://www.vupen.com/english/advisories/2006/2474"}, {"name": "20060622 Re: V3Chat Instant Messenger - XSS", "tags": ["mailing-list", "x_refsource_BUGTRAQ", "x_transferred"], "url": "http://www.securityfocus.com/archive/1/438069/100/200/threaded"}]}]}, "cveMetadata": {"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "cveId": "CVE-2006-3365", "datePublished": "2006-07-06T20:00:00", "dateReserved": "2006-07-06T00:00:00", "dateUpdated": "2024-08-07T18:23:21.280Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:v3_chat:v3_chat:beta:*:*:*:*:*:*:*", "matchCriteriaId": "1E8BA4F5-A0B1-4E17-9F90-5E8704FA7AEF", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "V3 Chat allows remote attackers to obtain the installation path via (1) an invalid id parameter to mail/index.php or (2) membername parameter to messenger/online.php, which displays the path in an error page due to an incorrect SQL statement."}, {"lang": "es", "value": "La aplicaci\u00f3n V3 Chat permite a atacantes remotos obtener la ruta de instalaci\u00f3n a trav\u00e9s de un par\u00e1metro (1) id inv\u00e1lido a mail/index.php o (2) membername a messenger/online.php, lo que hace que muestr la ruta en una p\u00e1gina de error debido a una declaraci\u00f3n incorrecta SQL."}], "id": "CVE-2006-3365", "lastModified": "2025-04-03T01:03:51.193", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "LOW", "cvssData": {"accessComplexity": "HIGH", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 2.6, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:N/AC:H/Au:N/C:P/I:N/A:N", "version": "2.0"}, "exploitabilityScore": 4.9, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": true}]}, "published": "2006-07-06T20:05:00.000", "references": [{"source": "cve@mitre.org", "tags": ["Exploit"], "url": "http://securitytracker.com/id?1016340"}, {"source": "cve@mitre.org", "url": "http://www.securityfocus.com/archive/1/437755/100/200/threaded"}, {"source": "cve@mitre.org", "url": "http://www.securityfocus.com/archive/1/438069/100/200/threaded"}, {"source": "cve@mitre.org", "url": "http://www.securityfocus.com/bid/18543"}, {"source": "cve@mitre.org", "tags": ["Vendor Advisory"], "url": "http://www.vupen.com/english/advisories/2006/2474"}, {"source": "cve@mitre.org", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/27395"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit"], "url": "http://securitytracker.com/id?1016340"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.securityfocus.com/archive/1/437755/100/200/threaded"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.securityfocus.com/archive/1/438069/100/200/threaded"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.securityfocus.com/bid/18543"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "http://www.vupen.com/english/advisories/2006/2474"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/27395"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-200"}], "source": "nvd@nist.gov", "type": "Primary"}]}