VULNERABILITY INTELLIGENCE
CVE-2006-4913
CVSS score7.5 HIGH
EPSS probability9.91%
CISA KEVNot currently listed
Published2006-09-21
Last modified2026-06-16
CVSS vectorAV:N/AC:L/Au:N/C:P/I:P/A:P
Description
Directory traversal vulnerability in chat/getStartOptions.php in AlstraSoft E-friends 4.85 allows remote attackers to include arbitrary local files and possibly execute arbitrary code via a .. (dot dot) sequence and trailing null (%00) byte in the lang parameter, as demonstrated by injecting PHP code into a log file.