PT-2006-6988 · Unknown · Uploadscript

Hack2Prison · Publicado 2006-12-07 · Atualizado 2018-10-17 · CVE-2006-6377

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Uploadscript versions 1.2 and earlier

Description The issue allows remote attackers to obtain the admin password hash due to insufficient access control of sensitive data stored under the web root. This can be achieved via a direct request for "/password.txt" API endpoint.

Recommendations For Uploadscript versions 1.2 and earlier, consider restricting access to the "/password.txt" file to prevent unauthorized access until a fix is available. Additionally, review and strengthen access controls for sensitive data stored under the web root.

Exploit

Correção

Identificadores relacionados

CVE-2006-6377

Produtos afetados

Uploadscript

Referências · 8

• 🔥 http://secunia.com/advisories/23264 · Exploit
• 🔥 https://exploit-db.com/exploits/10403 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2006-6377 · Nota de Segurança
• http://securityfocus.com/archive/1/457696/100/0/threaded · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/30747 · Nota
• http://vupen.com/english/advisories/2006/4893 · Nota
• http://securityreason.com/securityalert/2003 · Nota
• http://securityfocus.com/archive/1/453644/100/0/threaded · Nota