PT-2006-3482 · Destiney · Destiney Links Script

Luny · Publicado 2006-05-22 · Atualizado 2018-10-18 · CVE-2006-2535

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Destiney Links Script version 2.1.2

Description The issue allows remote attackers to obtain the installation path via an invalid show parameter referencing a non-existent file in index.php, which reveals the path in the resulting error message. This might be a symptom of a more serious issue, such as directory traversal.

Recommendations For Destiney Links Script version 2.1.2, consider restricting access to the index.php file or validating the show parameter to prevent the disclosure of the installation path. As a temporary workaround, restrict the use of the show parameter in index.php to minimize the risk of path disclosure.

Correção

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

CVE-2006-2535

Produtos afetados

Destiney Links Script

Referências · 6

• http://securityreason.com/securityalert/937 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2006-2535 · Nota de Segurança
• http://secunia.com/advisories/20248 · Aviso do Fabricante
• https://exchange.xforce.ibmcloud.com/vulnerabilities/26611 · Nota
• http://vupen.com/english/advisories/2006/1933 · Aviso do Fabricante
• http://securityfocus.com/archive/1/434692/100/0/threaded · Nota