PT-2006-4783 · X Atrix · X Atrix Xguestbook

Dicomdk · Publicado 2006-07-31 · Atualizado 2018-10-17 · CVE-2006-3937

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions x atrix xGuestBook version 1.02

Description The issue allows remote attackers to obtain sensitive information via a request without certain parameters, which reveals the installation path in an error message. Specifically, the absence of the user, mail, p, or url parameter in a request to the 'post.php' endpoint triggers this behavior.

Recommendations For x atrix xGuestBook version 1.02, consider restricting access to the 'post.php' endpoint to minimize the risk of exploitation, or ensure that all requests to this endpoint include at least one of the required parameters (user, mail, p, or url) to prevent the disclosure of sensitive information.

Correção

Identificadores relacionados

CVE-2006-3937

Produtos afetados

X Atrix Xguestbook

Referências · 4

• https://exchange.xforce.ibmcloud.com/vulnerabilities/27979 · Nota
• http://securityreason.com/securityalert/1304 · Nota
• http://securityfocus.com/archive/1/441170/100/0/threaded · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2006-3937 · Nota de Segurança