CVE-2006-0787

Public Exploit

Description

wimpy_trackplays.php in Plaino Wimpy MP3 Player, possibly 5.2 and earlier, allows remote attackers to insert arbitrary strings into trackme.txt via the (1) trackFile, (2) trackArtist, and (3) trackTitle parameters, which can result in providing false information about songs, occupying excessive disk space with very long parameter values, and storing executable code that might be invoked through a different vulnerability. NOTE: since this issue, as described by the original researcher, is entirely dependent on the presence of another vulnerability, it could be argued that Wimpy cannot be responsible for how its data file is processed by applications outside of its control. Since this issue might only be useful as a facilitator manipulation in another vulnerability, perhaps it should not be included in CVE.

4.0

CVSS

Severity: Medium

CVSS 2.0 •

EPSS 3.17% Top 15%

Vendor Advisory secunia.com Vendor Advisory xorcrew.net

Affected: n/a n/a

References

Link	Tags
http://www.securityfocus.com/bid/16696	vdb entry exploit
http://secunia.com/advisories/18900	third party advisory vendor advisory
http://www.xorcrew.net/xpa/XPA-WimpyMP3Player.txt	vendor advisory exploit
https://exchange.xforce.ibmcloud.com/vulnerabilities/24770	vdb entry

Frequently Asked Questions

What is the severity of CVE-2006-0787?: CVE-2006-0787 has been scored as a medium severity vulnerability.
How to fix CVE-2006-0787?: To fix CVE-2006-0787, make sure you are using an up-to-date version of the affected component(s) by checking the vendor release notes. As for now, there are no other specific guidelines available.
Is CVE-2006-0787 being actively exploited in the wild?: It is possible that CVE-2006-0787 is being exploited or will be exploited in a near future based on public information. According to its EPSS score, there is a ~3% probability that this vulnerability will be exploited by malicious actors in the next 30 days.

This platform uses data from the NIST NVD, MITRE CVE, MITRE CWE, First.org and CISA KEV but is not endorsed or certified by these entities. CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site.