PT-2004-2956 · Xlinesoft · Asprunner

Ferruh Mavituna · Published 2004-12-31 · Updated 2017-07-11 · CVE-2004-2060

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions ASPRunner version 2.4

Description The issue allows remote attackers to obtain the database by making a direct request to the database filename. The database filename is predictable based on table and field names, such as tablename and fieldname. This predictability may enable attackers to access the database via a direct request to the database filename.

Recommendations For ASPRunner version 2.4, consider moving the database outside of the web root directory to prevent direct access. As a temporary workaround, restrict access to the db directory to minimize the risk of exploitation.

Exploit

Fix

Related Identifiers

CVE-2004-2060

Affected Products

Asprunner

References · 10

• 🔥 http://ferruh.mavituna.com/article/?574 · Exploit
• 🔥 http://archives.neohapsis.com/archives/vulnwatch/2004-q3/0011.html · Exploit
• 🔥 https://exploit-db.com/exploits/24317 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2004-2060 · Security Note
• http://secunia.com/advisories/12164 · Note
• http://securitytracker.com/id?1010777 · Note
• http://securityfocus.com/bid/10799 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/16802 · Note
• http://osvdb.org/8253 · Note
• http://marc.info/?l=bugtraq&m=109086977330418&w=2 · Note