PT-2005-4667 · Freeguppy · Guppy

Retrogod · Publicado 2005-11-30 · Atualizado 2018-10-19 · CVE-2005-3927

Positive Technologies (AI Summary)

CVSS v2.0

6.4

Média

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions GuppY versions 4.5.9 and earlier

Description The issue allows remote attackers to read and include arbitrary files. This can be achieved via the meskin parameter to admin/editorTypetool.php, or the lng parameter to the scripts archbatch.php, dbbatch.php, and nwlmail.php in the admin/inc directory.

Recommendations For GuppY versions 4.5.9 and earlier, as a temporary workaround, consider restricting access to the admin/editorTypetool.php, archbatch.php, dbbatch.php, and nwlmail.php scripts until a patch is available. Avoid using the meskin and lng parameters in the affected scripts until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this issue.

Exploit

Correção

Identificadores relacionados

CVE-2005-3927

Produtos afetados

Guppy

Referências · 14

• 🔥 http://rgod.altervista.org/guppy459_xpl.html · Exploit
• 🔥 https://exploit-db.com/exploits/26641 · Exploit
• 🔥 https://exploit-db.com/exploits/26642 · Exploit
• 🔥 http://securityfocus.com/bid/15610 · Exploit
• 🔥 http://securitytracker.com/id?1015279 · Exploit
• 🔥 https://exploit-db.com/exploits/26640 · Exploit
• 🔥 https://exploit-db.com/exploits/26639 · Exploit
• http://secunia.com/advisories/17790 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2005-3927 · Nota de Segurança
• http://vupen.com/english/advisories/2005/2635 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/23319 · Nota
• http://securityreason.com/securityalert/212 · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-3927 · Nota
• http://securityfocus.com/archive/1/417899/100/0/threaded · Nota