PT-2011-3226 · Douran · Douran Portal

Hurr!C4Ne! + 1 · Publicado 2011-04-05 · Atualizado 2018-10-09 · CVE-2011-1569

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Douran Portal version 3.9.7.8

Description The issue allows remote attackers to obtain the source code of arbitrary files under the web root. This can be achieved through the "download.aspx" page by manipulating the FileNameAttach parameter with techniques such as appending a trailing ".", a trailing space, or using mixed case.

Recommendations For Douran Portal version 3.9.7.8, consider restricting access to the "download.aspx" page until a fix is available, and avoid using the FileNameAttach parameter with potentially vulnerable inputs.

Exploit

Correção

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

CVE-2011-1569

Produtos afetados

Douran Portal

Referências · 10

• 🔥 https://exploit-db.com/exploits/17011 · Exploit
• 🔥 http://exploit-db.com/exploits/17011 · Exploit
• 🔥 http://securityfocus.com/bid/46927 · Exploit
• http://secunia.com/advisories/43792 · Aviso do Fabricante
• http://securityfocus.com/archive/1/517085/100/0/threaded · Nota
• http://securityreason.com/securityalert/8180 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2011-1569 · Nota de Segurança
• http://soroush.secproject.com/blog/2011/01/unrestricted_file_download_v1_0 · Nota
• http://osvdb.org/71250 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/66177 · Nota