PT-2002-2766 · X-Stat · X-Stat

Published 2002-12-31 · Updated 2017-07-11 · CVE-2002-2045

Positive Technologies (AI Summary)

CVSS v2.0

6.4

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions x-stat versions 2.3 and earlier

Description The issue allows remote attackers to execute PHP commands, such as phpinfo, or obtain the full path of the web server. This is achieved via an invalid action parameter, which leaks the pathname in an error message.

Recommendations For versions 2.3 and earlier, consider restricting access to the x stat admin.php file until a patch is available. As a temporary workaround, avoid using invalid action parameters in the x stat admin.php file to minimize the risk of exploitation.

Exploit

Fix

Related Identifiers

CVE-2002-2045

Affected Products

X-Stat

References · 8

• 🔥 http://securitytracker.com/id?1003827 · Exploit
• http://ifrance.com/kitetoua/tuto/x_holes.txt · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2002-2045 · Security Note
• http://seclists.org/lists/vuln-dev/2002/Mar/0156.html · Note
• http://securityfocus.com/bid/4280 · Note
• http://securityfocus.com/bid/4279 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/8467 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/8466 · Note