Directory Traversal Vulnerability in Exponent CMS by Exponent Solutions
CVE-2006-4963

Currently unrated

Key Information:

Vendor

Exponent

Status
Exponent Cms
Vendor
CVE Published:
23 September 2006

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2006-4963?

A directory traversal vulnerability in Exponent CMS 0.96.3 allows remote attackers to exploit the system by manipulating the 'view' parameter in the 'show_view' action within the 'calendarmodule'. Through this exploitation, attackers can read and execute arbitrary local files, leading to potential unauthorized access to sensitive information including executing PHP code through session files.

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2006-4963 - Proof of Concept

References

http://www.osvdb.org/29024
vdb-entryx_refsource_OSVDB
https://www.exploit-db.com/exploits/2391
exploitx_refsource_EXPLOIT-DB
http://www.vupen.com/english/advisories/2006/3708
vdb-entryx_refsource_VUPEN

EPSS Score

7% chance of being exploited in the next 30 days.

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

.