PT-2007-1423 · Unknown · Call Center

Publicado 2007-03-07 · Atualizado 2018-10-16 · CVE-2006-7145

Positive Technologies (AI Summary)

CVSS v2.0

5.5

Média

Vetor base

AV:N/AC:L/Au:S/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Call Center Software versions 0.93 and earlier

Description The issue allows remote attackers to obtain sensitive information, such as account passwords, by modifying the user id parameter in the "edit user.php" endpoint.

Recommendations For Call Center Software versions 0.93 and earlier, avoid using the user id parameter in the edit user.php endpoint until the issue is resolved. Restrict access to the edit user.php endpoint to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this issue.

Exploit

Correção

Identificadores relacionados

CVE-2006-7145

Produtos afetados

Call Center

Referências · 8

• 🔥 http://archives.neohapsis.com/archives/fulldisclosure/2006-10/0217.html · Exploit
• 🔥 http://mayhemiclabs.com/advisories/MHL-2006-002.txt · Exploit
• http://securityfocus.com/archive/1/448423/100/0/threaded · Nota
• http://securityfocus.com/bid/20474 · Aviso do Fabricante
• http://securityreason.com/securityalert/2389 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2006-7145 · Nota de Segurança
• https://exchange.xforce.ibmcloud.com/vulnerabilities/29486 · Nota
• http://secunia.com/advisories/22365 · Aviso do Fabricante