Vulnerability Report

CVE-2006-5784

Title: Sap Sap Web Application Server Path Traversal / LFI

Arbitrary File Access

Proof Of Concept

PoC Available for CVE-2006-5784

CWE Category NVD-CWE-noinfo

Published Date Nov 07, 2006

Modified Date Jun 16, 2026

Exploit Status Available

Score 4.6 CVSS v2.0

Exploit Probability (EPSS)

2.92%

Vulnerability Summary

CVE-2006-5784: Unspecified vulnerability in enserver.exe in SAP Web Application Server 6.40 before patch 136 and 7.00 before patch 66 allows remote attackers to read arbitrary files via crafted data on a "3200+SYSNR" TCP port, as demonstrated by port 3201. NOTE: this issue can be leveraged by local users to access a named pipe as the SAPServiceJ2E user.

Impacted Vendors

sap 1

Reference Links

http://secunia.com/advisories/22677 http://securityreason.com/securityalert/1828 http://www.securityfocus.com/archive/1/450394/100/0/threaded http://www.securityfocus.com/archive/1/459499/100/0/threaded http://www.securityfocus.com/bid/20877 http://www.securitytracker.com/id?1017628 http://www.vupen.com/english/advisories/2006/4318 https://exchange.xforce.ibmcloud.com/vulnerabilities/29982 https://www.exploit-db.com/exploits/3291 http://secunia.com/advisories/22677 http://securityreason.com/securityalert/1828 http://www.securityfocus.com/archive/1/450394/100/0/threaded http://www.securityfocus.com/archive/1/459499/100/0/threaded http://www.securityfocus.com/bid/20877 http://www.securitytracker.com/id?1017628 http://www.vupen.com/english/advisories/2006/4318 https://exchange.xforce.ibmcloud.com/vulnerabilities/29982 https://www.exploit-db.com/exploits/3291

CVSS v2.0

Source Entity [email protected]

Severity MEDIUM

4.6

Access Vector

N/A

Authentication

N/A

RAW VECTOR AV:L/AC:L/Au:N/C:P/I:P/A:P

Associated Attack Patterns (CAPEC)

Total: Patterns

CVE-2006-5784 Exploits & PoCs (Proof Of Concept)

Exploit-DB https://www.exploit-db.com/exploits/3291

View Code

June 16, 2026 MODIFIED

Vulnerability data updated via NVD.

April 23, 2026 MODIFIED

Vulnerability data updated via NVD.

April 09, 2025 MODIFIED

Vulnerability data or affected products updated.

November 07, 2006 PUBLISHED

Vulnerability first announced in NVD.

Attack Vector Matrix

Access Vector N/A

Complexity N/A

Privileges N/A

Interaction NONE

CVSS Vector String


                                    AV:L/AC:L/Au:N/C:P/I:P/A:P

Affected Stack

No specific products linked.