PT-2006-3550 · Hyperstop+1 · Hyperstop Webhost Directory+1

Luny · Publicado 2006-05-26 · Atualizado 2018-10-18 · CVE-2006-2617

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions AlstraSoft Web Host Directory version 1.2 HyperStop WebHost Directory version 1.2

Description The issue allows remote attackers to obtain the installation path via an invalid entry in the Username field on the login page, which causes the path to be displayed in an SQL error. This might be a result of SQL injection.

Recommendations For AlstraSoft Web Host Directory version 1.2, consider validating user input in the Username field to prevent SQL errors that reveal sensitive information. For HyperStop WebHost Directory version 1.2, restrict access to the login page until a proper fix is applied to handle invalid input without disclosing the installation path.

Correção

Identificadores relacionados

CVE-2006-2617

Produtos afetados

Alstrasoft Web Host Directory

Hyperstop Webhost Directory

Referências · 10

• https://nvd.nist.gov/vuln/detail/CVE-2006-2617 · Nota de Segurança
• http://secunia.com/advisories/20276 · Aviso do Fabricante
• http://securityfocus.com/archive/1/434912/100/0/threaded · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/26656 · Nota
• http://secunia.com/advisories/20278 · Aviso do Fabricante
• http://sitepoint.com/forums/showthread.php?t=311969 · Nota
• http://securityreason.com/securityalert/955 · Nota
• http://vupen.com/english/advisories/2006/1972 · Nota
• http://vupen.com/english/advisories/2006/1973 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/26661 · Nota