PT-2008-1623 · Unknown · 2Z Project

Alexandr Polyakov + 1 · Publicado 2008-01-04 · Atualizado 2018-10-15 · CVE-2007-6660

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions 2z project version 0.9.6.1

Description The issue allows remote attackers to obtain sensitive information. This can be achieved through a request to index.php with an invalid template or a request to the default URI with certain year and month parameters. The vulnerability reveals the path in various error messages.

Recommendations For version 0.9.6.1, consider restricting access to the index.php file and limiting the input for year and month parameters to prevent exploitation until a patch is available. As a temporary workaround, avoid using invalid templates in requests to index.php and restrict the use of certain year and month parameters in requests to the default URI.

Exploit

Correção

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

CVE-2007-6660

Produtos afetados

2Z Project

Referências · 5

• 🔥 http://securityfocus.com/bid/27057 · Exploit
• http://securityfocus.com/archive/1/485590/100/0/threaded · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2007-6660 · Nota de Segurança
• http://securityreason.com/securityalert/3514 · Nota
• http://2z-project.ru/forum/viewtopic.php?pid=8309 · Nota