PT-2004-2956 · Xlinesoft · Asprunner

Ferruh Mavituna · Publicado 2004-12-31 · Atualizado 2017-07-11 · CVE-2004-2060

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions ASPRunner version 2.4

Description The issue allows remote attackers to obtain the database by making a direct request to the database filename. The database filename is predictable based on table and field names, such as tablename and fieldname. This predictability may enable attackers to access the database via a direct request to the database filename.

Recommendations For ASPRunner version 2.4, consider moving the database outside of the web root directory to prevent direct access. As a temporary workaround, restrict access to the db directory to minimize the risk of exploitation.

Exploit

Correção

Identificadores relacionados

CVE-2004-2060

Produtos afetados

Asprunner

Referências · 10

• 🔥 http://ferruh.mavituna.com/article/?574 · Exploit
• 🔥 http://archives.neohapsis.com/archives/vulnwatch/2004-q3/0011.html · Exploit
• 🔥 https://exploit-db.com/exploits/24317 · Exploit
• http://secunia.com/advisories/12164 · Nota
• http://securitytracker.com/id?1010777 · Nota
• http://securityfocus.com/bid/10799 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/16802 · Nota
• http://osvdb.org/8253 · Nota
• http://marc.info/?l=bugtraq&m=109086977330418&w=2 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2004-2060 · Nota de Segurança