PT-2005-2565 · Unknown · Quick.Forum

Lostmon · Publicado 2005-05-14 · Atualizado 2008-09-05 · CVE-2005-1586

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Quick.Forum version 2.1.6

Description The issue allows remote attackers to obtain potentially sensitive information, including usernames, banned IP addresses, censored words, and backups, by making a direct request to certain files. Specifically, attackers can access files such as db/users.txt, db/banList.txt, db/censureWords.txt, or backup files.

Recommendations For Quick.Forum version 2.1.6, consider moving sensitive files outside of the web document root to prevent direct access. As a temporary workaround, restrict access to the db directory and backup files to minimize the risk of exploitation.

Correção

Identificadores relacionados

CVE-2005-1586

Produtos afetados

Quick.Forum

Referências · 5

• http://osvdb.org/16329 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2005-1586 · Nota de Segurança
• http://secunia.com/advisories/15200 · Aviso do Fabricante
• http://osvdb.org/16328 · Aviso do Fabricante
• http://lostmon.blogspot.com/2005/05/quickforum-topic-field-xss-and-page.html · Aviso do Fabricante