CVE-2006-3392
CVE-2006-3392
Vexday Risk Score
60Attention
SSVC decision (CISA)
Attend
PoC available → attend closely
Exploit maturity
Functional exploit
Popular PoC on GitHub (14 stars) — exploitation code widely available.
CVSS —EPSS 78.0%KEV nãoPoC públicaNuclei simMetasploit simPatch referenciado
Lifecycle
30 Jun 2006Metasploit module available
06 Jul 2006Published on NVD
09 Jul 2006Public PoC
Weaponization speed
2 daysto first PoC
Weaponized quickly — attackers prioritized this vulnerability. Patch urgently.
Recommendation: Plan a near-term fix — a public PoC already exists.
Webmin before 1.290 and Usermin before 1.220 calls the simplify_path function before decoding HTML, which allows remote attackers to read arbitrary files, as demonstrated using "..%01" sequences, which bypass the removal of "../" sequences before bytes such as "%01" are removed from the filename. NOTE: This is a different issue than CVE-2006-3274.
Affected products
n/a · n/apublic PoCs found — 9
githubgithub.com/IvanGlinkin/CVE-2006-3392★ 14githubgithub.com/brosck/CVE-2006-3392★ 3githubgithub.com/0xtz/CVE-2006-3392★ 1githubgithub.com/g1vi/CVE-2006-3392★ 1githubgithub.com/kernel-cyber/CVE-2006-3392★ 0githubgithub.com/Adel-kaka-dz/CVE-2006-3392★ 0githubgithub.com/gb21oc/ExploitWebmin★ 0exploitdbwww.exploit-db.com/exploits/1997unverifiedexploitdbwww.exploit-db.com/exploits/2017unverified⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
References
http://attrition.org/pipermail/vim/2006-July/000923.htmlhttp://attrition.org/pipermail/vim/2006-June/000912.htmlhttp://secunia.com/advisories/20892http://secunia.com/advisories/21105http://secunia.com/advisories/21365http://secunia.com/advisories/22556http://security.gentoo.org/glsa/glsa-200608-11.xmlhttp://www.debian.org/security/2006/dsa-1199http://www.kb.cert.org/vuls/id/999601http://www.mandriva.com/security/advisories?name=MDKSA-2006:125http://www.osvdb.org/26772http://www.securityfocus.com/archive/1/439653/100/0/threaded