PT-2004-3091 · Zanfi · Zanfi Cms Lite

Publicado 2004-12-31 · Atualizado 2017-07-11 · CVE-2004-2196

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Zanfi CMS lite version 1.1

Description The issue allows remote attackers to obtain the full path of the web server via direct requests without required arguments to various PHP files, including "adm pages.php", "corr pages.php", "del block.php", "del page.php", "footer.php", "home.php", and others.

Recommendations For Zanfi CMS lite version 1.1, consider restricting direct access to sensitive PHP files, such as "adm pages.php", "corr pages.php", "del block.php", "del page.php", "footer.php", "home.php", and others, until a patch is available. As a temporary workaround, ensure that all requests to these files include the required arguments to prevent information disclosure.

Exploit

Correção

Identificadores relacionados

CVE-2004-2196

Produtos afetados

Zanfi Cms Lite

Referências · 12

• 🔥 http://securityfocus.com/archive/1/378053 · Exploit
• http://osvdb.org/10681 · Nota
• http://osvdb.org/10677 · Nota
• http://zanfi.nl/index1.php?flag=cmslite · Nota
• http://secunia.com/advisories/12792 · Aviso do Fabricante
• http://securitytracker.com/id?1011612 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2004-2196 · Nota de Segurança
• https://exchange.xforce.ibmcloud.com/vulnerabilities/17687 · Nota
• http://osvdb.org/10678 · Nota
• http://osvdb.org/10680 · Nota
• http://osvdb.org/10679 · Nota
• http://osvdb.org/10682 · Nota