CVE-2006-3360

Directory traversal vulnerability in index.php in phpSysInfo 2.5.1 allows remote attackers to determine the existence of arbitrary files via a .. (dot dot) sequence and a trailing null (%00) byte in the lng parameter, which will display a different error message if the file exists.

• CWE-22

• http://archives.neohapsis.com/archives/fulldisclosure/2006-07/0065.htmlBroken Link, Exploit
• http://archives.neohapsis.com/archives/fulldisclosure/2006-07/0066.htmlBroken Link, Exploit
• http://secunia.com/advisories/20939Broken Link, Vendor Advisory
• http://securitytracker.com/id?1016440Broken Link, Third Party Advisory, VDB Entry
• http://www.osvdb.org/27015Broken Link
• http://www.securityfocus.com/bid/18868Broken Link, Third Party Advisory, VDB Entry
• http://www.vupen.com/english/advisories/2006/2668Broken Link, Permissions Required, Third Party Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/27527Third Party Advisory, VDB Entry
• https://github.com/advisories/GHSA-2wxv-3g4v-p76pThird Party Advisory
• https://github.com/phpsysinfo/phpsysinfo/issues/368#issuecomment-1380842745Issue Tracking, Third Party Advisory
• http://archives.neohapsis.com/archives/fulldisclosure/2006-07/0065.htmlBroken Link, Exploit
• http://archives.neohapsis.com/archives/fulldisclosure/2006-07/0066.htmlBroken Link, Exploit
• http://secunia.com/advisories/20939Broken Link, Vendor Advisory
• http://securitytracker.com/id?1016440Broken Link, Third Party Advisory, VDB Entry
• http://www.osvdb.org/27015Broken Link
• http://www.securityfocus.com/bid/18868Broken Link, Third Party Advisory, VDB Entry
• http://www.vupen.com/english/advisories/2006/2668Broken Link, Permissions Required, Third Party Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/27527Third Party Advisory, VDB Entry
• https://github.com/advisories/GHSA-2wxv-3g4v-p76pThird Party Advisory
• https://github.com/phpsysinfo/phpsysinfo/issues/368#issuecomment-1380842745Issue Tracking, Third Party Advisory

Published

Jul 6, 2006

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2006-3354Microsoft Internet Explorer 6 allows remote attackers to cau…
• CVE-2006-3355Heap-based buffer overflow in httpdget.c in mpg123 before 0.…
• CVE-2006-3356The TIFFFetchAnyArray function in ImageIO in Apple OS X 10.4…
• CVE-2006-3357Heap-based buffer overflow in HTML Help ActiveX control (hhc…
• CVE-2006-3358Multiple cross-site scripting (XSS) vulnerabilities in index…
• CVE-2006-3359Multiple SQL injection vulnerabilities in index.php in NewsP…
• CVE-2006-3361PHP remote file inclusion vulnerability in Stud.IP 1.3.0-2 a…
• CVE-2006-3362Unrestricted file upload vulnerability in connectors/php/con…
• CVE-2006-3363PHP remote file inclusion vulnerability in index.php in the …
• CVE-2006-3364SQL injection vulnerability in index.php in the NP_SEO plugi…
• CVE-2006-3365V3 Chat allows remote attackers to obtain the installation p…
• CVE-2006-3366Multiple cross-site scripting (XSS) vulnerabilities in V3 Ch…