PT-2004-3091 · Zanfi · Zanfi Cms Lite

Published 2004-12-31 · Updated 2017-07-11 · CVE-2004-2196

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Zanfi CMS lite version 1.1

Description The issue allows remote attackers to obtain the full path of the web server via direct requests without required arguments to various PHP files, including "adm pages.php", "corr pages.php", "del block.php", "del page.php", "footer.php", "home.php", and others.

Recommendations For Zanfi CMS lite version 1.1, consider restricting direct access to sensitive PHP files, such as "adm pages.php", "corr pages.php", "del block.php", "del page.php", "footer.php", "home.php", and others, until a patch is available. As a temporary workaround, ensure that all requests to these files include the required arguments to prevent information disclosure.

Exploit

Fix

Related Identifiers

CVE-2004-2196

Affected Products

Zanfi Cms Lite

References · 12

• 🔥 http://securityfocus.com/archive/1/378053 · Exploit
• http://secunia.com/advisories/12792 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2004-2196 · Security Note
• http://osvdb.org/10681 · Note
• http://osvdb.org/10677 · Note
• http://zanfi.nl/index1.php?flag=cmslite · Note
• http://securitytracker.com/id?1011612 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/17687 · Note
• http://osvdb.org/10678 · Note
• http://osvdb.org/10680 · Note
• http://osvdb.org/10679 · Note
• http://osvdb.org/10682 · Note