PT-2002-2608 · Tightauction · Tightauction

Published 2002-12-31 · Updated 2008-09-05 · CVE-2002-1886

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions TightAuction version 3.0

Description The issue allows remote attackers to obtain the database username and password due to insufficient access control of the config.inc file, which is stored under the web document root.

Recommendations For TightAuction version 3.0, consider moving the config.inc file outside of the web document root or implementing proper access controls to restrict unauthorized access to this file. As a temporary workaround, restrict access to the config.inc file to minimize the risk of exploitation.

Exploit

Fix

Related Identifiers

CVE-2002-1886

Affected Products

Tightauction

References · 5

• 🔥 https://exploit-db.com/exploits/21893 · Exploit
• 🔥 http://archives.neohapsis.com/archives/bugtraq/2002-10/0016.html · Exploit
• 🔥 http://securityfocus.com/bid/5850 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2002-1886 · Security Note
• http://iss.net/security_center/static/10310.php · Note