PT-2009-3151 · Vgbook · Virtual Guestbook

Moudi · Publicado 2009-02-10 · Atualizado 2017-09-29 · CVE-2009-0498

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Virtual GuestBook (vgbook) version 2.1

Description The issue concerns the storage of sensitive information under the web root with insufficient access control. This allows remote attackers to download the database file via a direct request to the guestbook.mdb file.

Recommendations For Virtual GuestBook (vgbook) version 2.1, consider restricting access to the guestbook.mdb file to prevent unauthorized downloads. As a temporary workaround, move the sensitive information outside of the web root to minimize the risk of exploitation.

Exploit

Correção

Enumeração de Fraquezas

CWE-264

Identificadores relacionados

CVE-2009-0498

Produtos afetados

Virtual Guestbook

Referências · 2

• 🔥 https://exploit-db.com/exploits/7744 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2009-0498 · Nota de Segurança