PT-2002-2445 · Unknown · Powerboards

Published 2002-12-31 · Updated 2017-07-11 · CVE-2002-1723

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Powerboards version 2.2b

Description The issue allows remote attackers to view the full path to the backend database. This can be achieved by sending a cookie containing a non-existent username to the "profiles.php" endpoint, which displays the full path in the error message.

Recommendations For Powerboards version 2.2b, consider restricting access to the "profiles.php" endpoint until a patch is available, or modify the error handling to prevent the disclosure of sensitive path information.

Fix

Related Identifiers

CVE-2002-1723

Affected Products

Powerboards

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2002-1723 · Security Note
• http://ifrance.com/kitetoua/tuto/powerboards.txt · Vendor Advisory
• http://online.securityfocus.com/archive/82/266665 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/8824 · Note