CVE-2006-6690

HighCVSS 7.5/10Last modified Jun 16, 2026

Description

rtehtmlarea/pi1/class.tx_rtehtmlarea_pi1.php in Typo3 4.0.0 through 4.0.3, 3.7 and 3.8 with the rtehtmlarea extension, and 4.1 beta allows remote authenticated users to execute arbitrary commands via shell metacharacters in the userUid parameter to rtehtmlarea/htmlarea/plugins/SpellChecker/spell-check-logic.php, and possibly another vector.

Metrics

CVSS 2.0 7.5/10AV:N/AC:L/Au:N/C:P/I:P/A:P

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://lists.netfielders.de/pipermail/typo3-announce/2006/000045.htmlVendor Advisory
http://lists.netfielders.de/pipermail/typo3-announce/2006/000046.htmlVendor Advisory
http://secunia.com/advisories/23446Patch, Vendor Advisory
http://secunia.com/advisories/23466Patch, Vendor Advisory
http://securityreason.com/securityalert/2056
http://securitytracker.com/id?1017428Exploit, Patch
http://typo3.org/news-single-view/?tx_newsimporter_pi1%5BshowItem%5D=0&cHash=e4a40a11a9
http://www.sec-consult.com/272.htmlExploit
http://www.securityfocus.com/archive/1/454944/100/0/threaded
http://www.securityfocus.com/bid/21680Exploit, Patch
http://www.vupen.com/english/advisories/2006/5094
http://lists.netfielders.de/pipermail/typo3-announce/2006/000045.htmlVendor Advisory
http://lists.netfielders.de/pipermail/typo3-announce/2006/000046.htmlVendor Advisory
http://secunia.com/advisories/23446Patch, Vendor Advisory
http://secunia.com/advisories/23466Patch, Vendor Advisory
http://securityreason.com/securityalert/2056
http://securitytracker.com/id?1017428Exploit, Patch
http://typo3.org/news-single-view/?tx_newsimporter_pi1%5BshowItem%5D=0&cHash=e4a40a11a9
http://www.sec-consult.com/272.htmlExploit
http://www.securityfocus.com/archive/1/454944/100/0/threaded
http://www.securityfocus.com/bid/21680Exploit, Patch
http://www.vupen.com/english/advisories/2006/5094

Timeline

Published: Dec 21, 2006
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2006

CVE-2006-66917.5Multiple PHP remote file inclusion vulnerabilities in Valdersoft Shopping Cart 3.0 and earlier allow remote attackers to execute arbitrary P CVE-2006-66927.5Multiple format string vulnerabilities in zabbix before 20061006 allow attackers to cause a denial of service (application crash) and possib CVE-2006-66937.5Multiple buffer overflows in zabbix before 20061006 allow attackers to cause a denial of service (application crash) and possibly execute ar CVE-2006-66947.5Directory traversal vulnerability in include/config.php in E-Uploader Pro 1.0 and earlier allows remote attackers to execute arbitrary PHP c CVE-2006-66956.8Multiple cross-site scripting (XSS) vulnerabilities in index.php in Carsen Klock TextSend 1.5 allow remote attackers to inject arbitrary web CVE-2006-66966.9Double free vulnerability in Microsoft Windows 2000, XP, 2003, and Vista allows local users to gain privileges by calling the MessageBox fun CVE-2006-66977.5CRLF injection vulnerability in webapp/jsp/calendar.jsp in Oracle Portal 10g and earlier, including 9.0.2, allows remote attackers to inject CVE-2006-66981.9The GConf daemon (gconfd) in GConf 2.14.0 creates temporary files under directories with names based on the username, even when GCONF_GLOBAL CVE-2006-66995.0Multiple CRLF injection vulnerabilities in Oracle Portal 9.0.2 and possibly other versions allow remote attackers to inject arbitrary HTTP h CVE-2006-67006.8Cross-site scripting (XSS) vulnerability in @Mail WebMail allows remote attackers to inject arbitrary web script or HTML via unspecified vec CVE-2006-67017.5Cross-site request forgery (CSRF) vulnerability in util.pl in @Mail WebMail 4.51, and util.php in 5.x before 5.03, allows remote attackers t CVE-2006-67026.8Cross-site scripting (XSS) vulnerability in Global.pm in @Mail before 4.61 allows remote attackers to inject arbitrary web script or HTML vi