PT-2009-1332 · Myphpscripts · Myphpscripts Login Session

Osirys · Publicado 2009-01-06 · Atualizado 2017-09-29 · CVE-2008-5855

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions myPHPscripts Login Session version 2.0

Description The issue allows remote attackers to discover sensitive information, including usernames, e-mail addresses, and password hashes, by making a direct request for the users.txt file. This is due to insufficient access control for sensitive information stored under the web root.

Recommendations For myPHPscripts Login Session version 2.0, consider restricting access to the users.txt file to prevent unauthorized disclosure of sensitive information. As a temporary workaround, restrict access to the web root directory to minimize the risk of exploitation.

Exploit

Correção

Enumeração de Fraquezas

CWE-264

Identificadores relacionados

CVE-2008-5855

Produtos afetados

Myphpscripts Login Session

Referências · 5

• 🔥 https://exploit-db.com/exploits/7526 · Exploit
• http://secunia.com/advisories/33253 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2008-5855 · Nota de Segurança
• https://exchange.xforce.ibmcloud.com/vulnerabilities/47502 · Nota
• http://securityreason.com/securityalert/4873 · Nota