PT-2004-2957 · Isearch · Isearch+1

Published 2004-07-27 · Updated 2024-02-08 · CVE-2004-2061

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions RiSearch version 1.0.01 RiSearch Pro version 3.2.06

Description The issue allows remote attackers to use the show.pl script as an open proxy or read arbitrary local files by setting the url parameter to a http://, ftp://, or file:// URL.

Recommendations For RiSearch version 1.0.01, restrict access to the show.pl script to minimize the risk of exploitation. For RiSearch Pro version 3.2.06, avoid using the url parameter in the show.pl script until the issue is resolved. As a temporary workaround, consider disabling the show.pl script until a patch is available.

Exploit

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2004-2061

Affected Products

Isearch

Risearch Pro

References · 11

• 🔥 https://exploit-db.com/exploits/24326 · Exploit
• 🔥 https://exploit-db.com/exploits/24327 · Exploit
• 🔥 http://securityfocus.com/bid/10812 · Exploit
• http://secunia.com/advisories/12173 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2004-2061 · Security Note
• http://securitytracker.com/id?1010788 · Note
• http://osvdb.org/8266 · Note
• http://osvdb.org/8265 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/16817 · Note
• http://marc.info/?l=bugtraq&m=109095196526490&w=2 · Note
• https://t.me/cvenotify/70645 · Telegram Post