GHSA-2wxv-3g4v-p76pMedium

phpSysInfo allows remote attackers to determine the existence of arbitrary files via a .. (dot dot) sequence

Published
May 1, 2022
Last Modified
March 30, 2023

🔗 CVE IDs covered (1)

CVE-2006-3360 →

📋 Description

Directory traversal vulnerability in index.php in phpSysInfo prior to 3.2.5 allows remote attackers to determine the existence of arbitrary files via a .. (dot dot) sequence and a trailing null (%00) byte in the lng parameter, which will display a different error message if the file exists.

🎯 Affected products1

  • composer/phpsysinfo/phpsysinfo:< 3.2.5

🔗 References (6)