PT-2002-2448 · Photodb · Photodb

Publicado 2002-12-31 · Atualizado 2017-07-11 · CVE-2002-1726

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions PhotoDB version 1.4

Description The issue allows remote attackers to bypass authentication. This can be achieved by manipulating the URL with a large Time parameter, non-empty rmtusername and rmtpassword parameters, and an accesslevel parameter that is lower than the access level of the requested page.

Recommendations For PhotoDB version 1.4, consider restricting access to the secure inc.php file until a patch is available, and ensure that the accesslevel parameter is properly validated to prevent unauthorized access.

Correção

Identificadores relacionados

CVE-2002-1726

Produtos afetados

Photodb

Referências · 5

• http://online.securityfocus.com/archive/82/270970 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2002-1726 · Nota de Segurança
• https://exchange.xforce.ibmcloud.com/vulnerabilities/9002 · Nota
• http://securityfocus.com/bid/4669 · Nota
• http://ifrance.com/kitetoua/tuto/5holes4.txt · Aviso do Fabricante