PT-2002-2608 · Tightauction · Tightauction

Publicado 2002-12-31 · Atualizado 2008-09-05 · CVE-2002-1886

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions TightAuction version 3.0

Description The issue allows remote attackers to obtain the database username and password due to insufficient access control of the config.inc file, which is stored under the web document root.

Recommendations For TightAuction version 3.0, consider moving the config.inc file outside of the web document root or implementing proper access controls to restrict unauthorized access to this file. As a temporary workaround, restrict access to the config.inc file to minimize the risk of exploitation.

Exploit

Correção

Identificadores relacionados

CVE-2002-1886

Produtos afetados

Tightauction

Referências · 5

• 🔥 https://exploit-db.com/exploits/21893 · Exploit
• 🔥 http://archives.neohapsis.com/archives/bugtraq/2002-10/0016.html · Exploit
• 🔥 http://securityfocus.com/bid/5850 · Exploit
• http://iss.net/security_center/static/10310.php · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2002-1886 · Nota de Segurança