PT-2004-3621 · Netbilling · Netbilling

Publicado 2004-12-31 · Atualizado 2017-07-29 · CVE-2004-2732

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Netbilling version 2.0

Description The issue allows remote attackers to obtain sensitive information. This can be achieved by leveraging the cmd parameter, specifically the test option, to determine the access key.

Recommendations For Netbilling version 2.0, consider restricting access to the nbmember.cgi script until a patch is available. As a temporary workaround, avoid using the cmd=test option in the nbmember.cgi script to minimize the risk of exploitation.

Exploit

Correção

OS Command Injection

Enumeração de Fraquezas

CWE-78

Identificadores relacionados

CVE-2004-2732

Produtos afetados

Netbilling

Referências · 7

• 🔥 http://securityfocus.com/bid/11504 · Exploit
• 🔥 https://exploit-db.com/exploits/24700 · Exploit
• http://osvdb.org/10902 · Nota
• http://securitytracker.com/id?1011881 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2004-2732 · Nota de Segurança
• http://web.archive.org/web/20041106200147/http://it-helpnet.de/bugless/bugs.php?mode=show&id=8&SID= · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/17865 · Nota