PT-2004-2957 · Isearch · Isearch+1

CVE-2004-2061 · Publicado 2004-07-27 · Atualizado 2024-02-08

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions RiSearch version 1.0.01 RiSearch Pro version 3.2.06

Description The issue allows remote attackers to use the show.pl script as an open proxy or read arbitrary local files by setting the url parameter to a http://, ftp://, or file:// URL.

Recommendations For RiSearch version 1.0.01, restrict access to the show.pl script to minimize the risk of exploitation. For RiSearch Pro version 3.2.06, avoid using the url parameter in the show.pl script until the issue is resolved. As a temporary workaround, consider disabling the show.pl script until a patch is available.

Exploit

Correção

SSRF

Enumeração de Fraquezas

CWE-918

Identificadores relacionados

CVE-2004-2061

Produtos afetados

Isearch

Risearch Pro

Referências · 11

• 🔥 https://exploit-db.com/exploits/24326 · Exploit
• 🔥 https://exploit-db.com/exploits/24327 · Exploit
• 🔥 http://securityfocus.com/bid/10812 · Exploit
• http://securitytracker.com/id?1010788 · Nota
• http://osvdb.org/8266 · Nota
• http://secunia.com/advisories/12173 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2004-2061 · Nota de Segurança
• http://osvdb.org/8265 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/16817 · Nota
• http://marc.info/?l=bugtraq&m=109095196526490&w=2 · Nota
• https://t.me/cvenotify/70645 · Publicação no Telegram