PT-2004-3554 · John Lim · Adodb Library

Published 2004-12-31 · Updated 2008-09-05 · CVE-2004-2664

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions John Lim ADOdb Library for PHP versions prior to 4.23

Description The issue allows remote attackers to obtain sensitive information via direct requests to certain scripts. This occurs when the ADODB DIR value is undefined, resulting in an error message that reveals the installation path.

Recommendations For versions prior to 4.23, update to version 4.23 or later to resolve the issue. As a temporary workaround, consider defining the ADODB DIR value to prevent the error message from revealing sensitive information. Restrict access to the affected scripts to minimize the risk of exploitation.

Fix

Related Identifiers

CVE-2004-2664

Affected Products

Adodb Library

References · 5

• https://osv.dev/vulnerability/CVE-2004-2664 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2004-2664 · Security Note
• http://phplens.com/lens/adodb/docs-adodb.htm#changes · Patch
• https://osv.dev/vulnerability/DEBIAN-CVE-2004-2664 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2004-2664 · Vendor Advisory