CVE-2006-3360: phpSysInfo Directory Traversal Vulnerability
Summary
CVE-2006-3360: Directory traversal vulnerability in index.php in phpSysInfo prior to 3.2.5 allows remote attackers to determine the existence of arbitrary files via a .. Affects phpsysinfo/phpsysinfo versions < 3.2.5. Fixed in 3.2.5. How to fix ↓
Also tracked for
- phpsysinfo · Debian:11
The same CVE-2006-3360 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
phpSysInfo is a PHP-based script that displays information about the host system. It provides detailed information on various aspects such as hardware, software, and network settings. The vulnerability in phpSysInfo prior to version 3.2.5 allows remote attackers to determine the existence of arbitrary files through a directory traversal attack. By exploiting this vulnerability, an attacker can manipulate the 'lng' parameter to include a '..' sequence and a trailing null byte (%00), which will result in different error messages depending on the existence of the specified file.
Vulnerability Detail
The directory traversal vulnerability in phpSysInfo allows an attacker to bypass file access restrictions and determine the existence of arbitrary files on the server. By carefully crafting the 'lng' parameter, an attacker can traverse directories and access sensitive files that should not be publicly accessible. This can lead to information disclosure, as the attacker can gather information about the system's configuration, potentially exposing sensitive data. The vulnerability has a moderate severity rating (CWE-22).
How To Fix
Minimum fixed version
3.2.5
This is the first release that contains the fix.
composer require phpsysinfo/phpsysinfo:3.2.5Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the latest version is not immediately possible, users can implement a temporary workaround by manually validating the 'lng' parameter before processing it. This can be done by checking if the parameter contains any '..' sequences or null bytes (%00) and rejecting the request if found. Here's an example of how to implement this check in PHP:
if (strpos($_GET['lng'], '..') !== false || strpos($_GET['lng'], '%00') !== false) {
die('Invalid request');
}
Conclusion
The directory traversal vulnerability in phpSysInfo prior to version 3.2.5 allows remote attackers to determine the existence of arbitrary files on the server. It is recommended to upgrade to the latest version or apply the provided workaround to mitigate the risk of information disclosure. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for phpsysinfo/phpsysinfo →
FAQ
phpSysInfo is a PHP-based script that provides detailed information about the host system, including hardware, software, and network settings.
A directory traversal vulnerability allows an attacker to access files outside of the intended directory by manipulating input parameters and traversing directory structures.
By exploiting this vulnerability, an attacker can determine the existence of arbitrary files on the server, potentially leading to information disclosure and exposing sensitive data.
To fix this vulnerability, upgrade to phpSysInfo version 3.2.5 or later. Alternatively, implement the provided workaround until the upgrade can be applied.
Yes, you can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities without requiring access to the code or installation.
References
Related vulnerabilities
Recent vulnerabilities recorded for phpsysinfo/phpsysinfo.
