PT-2005-2949 · Unknown · Ultimate Php Board

Alberto Trivero · Publicado 2005-06-16 · Atualizado 2016-10-18 · CVE-2005-2003

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Ultimate PHP Board (UPB) version 1.9.6 GOLD

Description The issue allows remote attackers to obtain sensitive information by providing an invalid id parameter, set to zero, to specific API endpoints, including "viewtopic.php", "profile.php", or "newpost.php". This action reveals the path in an error message.

Recommendations For Ultimate PHP Board (UPB) version 1.9.6 GOLD, consider validating the id parameter to prevent the disclosure of sensitive information. As a temporary workaround, restrict access to the "viewtopic.php", "profile.php", and "newpost.php" endpoints to minimize the risk of exploitation. Avoid using the id parameter with a value of zero in these endpoints until the issue is resolved.

Correção

Identificadores relacionados

CVE-2005-2003

Produtos afetados

Ultimate Php Board

Referências · 3

• http://secunia.com/advisories/15732 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2005-2003 · Nota de Segurança
• http://marc.info/?l=bugtraq&m=111893777504821&w=2 · Nota