PT-2006-6750 · Unknown · Monkey Boards

Jesper Jurcenoks · Publicado 2006-11-28 · Atualizado 2018-10-17 · CVE-2006-6113

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Monkey Boards version 0.3.5

Description The issue allows remote attackers to obtain sensitive information via direct requests to API endpoints such as "include/admin auth.inc.php" and "include/engine/class.compiler.php". This occurs because these endpoints reveal the full path in an error message. It is noted that this issue only constitutes an exposure if the administrator has changed the default script path.

Recommendations For Monkey Boards version 0.3.5, consider restricting access to the "include/admin auth.inc.php" and "include/engine/class.compiler.php" endpoints to minimize the risk of exploitation. Additionally, administrators should review their script path configurations to ensure they are using the default settings, thereby reducing the exposure risk.

Exploit

Correção

Identificadores relacionados

CVE-2006-6113

Produtos afetados

Monkey Boards

Referências · 7

• 🔥 http://netvigilance.com/advisory0009 · Exploit
• http://osvdb.org/30683 · Nota
• http://osvdb.org/30684 · Nota
• http://sourceforge.net/tracker/index.php?func=detail&aid=1603389&group_id=165094&atid=834302 · Nota
• http://lists.grok.org.uk/pipermail/full-disclosure/2006-November/050969.html · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2006-6113 · Nota de Segurança
• http://securityfocus.com/archive/1/452994/100/0/threaded · Nota