PT-2002-1496 · Php · Phpfirstpost

Published 2002-07-26 · Updated 2008-09-05 · CVE-2002-0445

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions PHP FirstPost version 0.1

Description The issue allows remote attackers to obtain the full pathname of the server. This is achieved by providing an invalid post number in the post parameter, which results in the pathname being leaked in an error message.

Recommendations For PHP FirstPost version 0.1, consider validating and sanitizing the post parameter to prevent the disclosure of sensitive information. As a temporary workaround, restrict access to the article.php file to minimize the risk of exploitation.

Fix

Related Identifiers

CVE-2002-0445

Affected Products

Phpfirstpost

References · 5

• http://securityfocus.com/bid/4274 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2002-0445 · Security Note
• http://iss.net/security_center/static/8434.php · Vendor Advisory
• http://securityfocus.com/archive/1/261337 · Vendor Advisory
• http://osvdb.org/7170 · Note