PT-2009-4533 · Mrcgiguy · Mrcgiguy The Ticket System

The G0Bl!N · Publicado 2009-06-16 · Atualizado 2017-09-29 · CVE-2009-2080

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions MRCGIGUY The Ticket System version 2.0

Description The issue allows remote attackers to obtain sensitive configuration information or change the administrator's password. This can be achieved by accessing the admin.php file, which does not properly restrict access. Specifically, attackers can obtain configuration information via the editconfig action or change the administrator's password via the id parameter in an editop action.

Recommendations For MRCGIGUY The Ticket System version 2.0, restrict access to the admin.php file to prevent unauthorized modifications and information disclosure. As a temporary workaround, consider disabling the editconfig and editop actions until a proper fix is applied. Additionally, restrict the use of the id parameter in the editop action to minimize the risk of password changes by unauthorized users.

Exploit

Correção

Enumeração de Fraquezas

CWE-264

Identificadores relacionados

CVE-2009-2080

Produtos afetados

Mrcgiguy The Ticket System

Referências · 4

• 🔥 https://exploit-db.com/exploits/8917 · Exploit
• https://exchange.xforce.ibmcloud.com/vulnerabilities/51029 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2009-2080 · Nota de Segurança
• http://secunia.com/advisories/35350 · Aviso do Fabricante