PT-2006-6621 · Xlinesoft · Phprunner

Lostmon · Publicado 2006-11-17 · Atualizado 2008-09-05 · CVE-2006-5956

Positive Technologies (AI Summary)

CVSS v2.0

2.1

Baixa

Vetor base

AV:L/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions XLineSoft PHPRunner version 3.1

Description The issue allows local users to obtain sensitive information, including database server names, database names, usernames, and passwords, which are stored in plaintext in the %WINDIR%PHPRunner.ini file.

Recommendations For XLineSoft PHPRunner version 3.1, consider restricting access to the PHPRunner.ini file to minimize the risk of exploitation. As a temporary workaround, limit local user access to sensitive information stored in the file until a more secure method of storing this data is implemented.

Correção

Identificadores relacionados

CVE-2006-5956

Produtos afetados

Phprunner

Referências · 6

• http://osvdb.org/30363 · Nota
• http://lostmon.blogspot.com/2006/11/phprunner-database-credentials.html · Nota
• http://securitytracker.com/id?1017218 · Nota
• http://secunia.com/advisories/22863 · Nota
• http://securityfocus.com/bid/21054 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2006-5956 · Nota de Segurança