PT-2007-4353 · Cactushop · Cactushop

Publicado 2007-06-06 · Atualizado 2018-10-16 · CVE-2007-3061

Positive Technologies (AI Summary)

CVSS v2.0

7.8

Alta

Vetor base

AV:N/AC:L/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions: Cactushop versions 6 and earlier

Description: The issue allows remote attackers to download a database via a direct request for files such as cactushop6.mdb or cactushop5.mdb due to insufficient access control. This is because sensitive information is stored under the web root.

Recommendations: For Cactushop versions 6 and earlier, restrict access to the database files cactushop6.mdb and cactushop5.mdb to prevent unauthorized downloads. Consider implementing proper access controls for sensitive information stored under the web root.

Exploit

Correção

Enumeração de Fraquezas

CWE-255

Identificadores relacionados

CVE-2007-3061

Produtos afetados

Cactushop

Referências · 8

• 🔥 https://exploit-db.com/exploits/10686 · Exploit
• http://securityreason.com/securityalert/2780 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2007-3061 · Nota de Segurança
• http://osvdb.org/42052 · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3061 · Nota
• http://osvdb.org/42053 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/34706 · Nota
• http://securityfocus.com/archive/1/470439/100/0/threaded · Nota