VYPR
← All advisories
Moderate severityNVD Advisory· Published Jul 6, 2006· Updated Apr 16, 2026

CVE-2006-3360

CVE-2006-3360

Description

Directory traversal vulnerability in index.php in phpSysInfo 2.5.1 allows remote attackers to determine the existence of arbitrary files via a .. (dot dot) sequence and a trailing null (%00) byte in the lng parameter, which will display a different error message if the file exists.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
phpsysinfo/phpsysinfoPackagist
< 3.2.53.2.5

Affected products

1

Patches

1
60b5bbb5d1cc

issue #107 fix

https://github.com/phpsysinfo/phpsysinfonamiltdFeb 1, 2016via ghsa
commit
1 file changed · +14 −13
  • language/language.php+14 −13 modified
    @@ -45,24 +45,25 @@
     $lang = PSI_DEFAULT_LANG;
 }
 
-if (isset($_GET['lang'])) {
-    if (file_exists(APP_ROOT.'/language/'.trim(htmlspecialchars(basename($_GET['lang']))).'.xml')) {
-        $lang = basename($_GET['lang']);
-    }
+if (isset($_GET['lang']) && (trim($_GET['lang'])!=="")
+   && !preg_match('/[^A-Za-z\-_]/', $_GET['lang'])
+   && file_exists(APP_ROOT.'/language/'.$_GET['lang'].'.xml')) {
+    $lang = $_GET['lang'];
 }
 
-$plugin = isset($_GET['plugin']) ? trim(htmlspecialchars(basename($_GET['plugin']))) : null;
-
-if ($plugin == null) {
+if (isset($_GET['plugin'])) {
+   if ((trim($_GET['plugin'])!=="") && !preg_match('/[^A-Za-z\-_]/', $_GET['plugin'])) {
+       $plugin = $_GET['plugin'];
+        if (file_exists(APP_ROOT.'/plugins/'.strtolower($plugin).'/lang/'.$lang.'.xml')) {
+            echo file_get_contents(APP_ROOT.'/plugins/'.strtolower($plugin).'/lang/'.$lang.'.xml');
+        } elseif (file_exists(APP_ROOT.'/plugins/'.strtolower($plugin).'/lang/en.xml')) {
+            echo file_get_contents(APP_ROOT.'/plugins/'.strtolower($plugin).'/lang/en.xml');
+        }
+   }
+} else {
     if (file_exists(APP_ROOT.'/language/'.$lang.'.xml')) {
         echo file_get_contents(APP_ROOT.'/language/'.$lang.'.xml');
     } else {
         echo file_get_contents(APP_ROOT.'/language/en.xml');
     }
-} else {
-    if (file_exists(APP_ROOT.'/plugins/'.strtolower($plugin).'/lang/'.$lang.'.xml')) {
-        echo file_get_contents(APP_ROOT.'/plugins/'.strtolower($plugin).'/lang/'.$lang.'.xml');
-    } else {
-        echo file_get_contents(APP_ROOT.'/plugins/'.strtolower($plugin).'/lang/en.xml');
-    }
 }

Vulnerability mechanics

Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

13

News mentions

0

No linked articles in our index yet.