CVE-2006-3392

Webmin before 1.290 and Usermin before 1.220 calls the simplify_path function before decoding HTML, which allows remote attackers to read arbitrary files, as demonstrated using "..%01" sequences, which bypass the removal of "../" sequences before bytes such as "%01" are removed from the filename. NOTE: This is a different issue than CVE-2006-3274.

CVSS v2.0

5.0 MEDIUMAV:N/AC:L/Au:N/C:P/I:N/A:N

EPSS

78.29% chance of exploitation in the next 30 days, 100th percentile

Nuclei

medium · CWE-22

Published

2006-07-06

Updated

2024-08-07

Proof-of-concept exploits (13)

• http://www.securityfocus.com/archive/1/440125/100/0/threaded
• http://www.securityfocus.com/archive/1/440466/100/0/threaded
• http://www.securityfocus.com/archive/1/439653/100/0/threaded
• 0xtz/CVE-2006-33921★ · 2020-06-30
• Adel-kaka-dz/CVE-2006-33920★ · 2021-11-03
• IvanGlinkin/CVE-2006-339214★ · 2023-03-09
• MrEmpy/CVE-2006-33923★ · 2024-12-07
• brosck/CVE-2006-33923★ · 2024-12-07
• g1vi/CVE-2006-33921★ · 2023-10-09
• gb21oc/ExploitWebmin0★ · 2023-01-04
• kernel-cyber/CVE-2006-33920★ · 2022-09-15
• windsormoreira/CVE-2006-33920★ · 2022-09-15
• Adel-hx0d/CVE-2006-3392

Nuclei templates (1)

• projectdiscovery/nuclei-templates/blob/main/http/cves/2006/CVE-2006-3392.yaml

Metasploit modules (1)

• rapid7/metasploit-framework/blob/master/modules/auxiliary/admin/webmin/file_disclosure.rb

ExploitDB entries (2)

• https://www.exploit-db.com/exploits/2017
• https://www.exploit-db.com/exploits/1997

References

• CVE Record
• NVD entry

Related

• CVE-2024-36821
• CVE-2022-1077
• CVE-2022-4944
• CVE-2006-3274
• CVE-2010-0426
• CVE-2019-15107