PT-2004-3621 · Netbilling · Netbilling

Published 2004-12-31 · Updated 2017-07-29 · CVE-2004-2732

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Netbilling version 2.0

Description The issue allows remote attackers to obtain sensitive information. This can be achieved by leveraging the cmd parameter, specifically the test option, to determine the access key.

Recommendations For Netbilling version 2.0, consider restricting access to the nbmember.cgi script until a patch is available. As a temporary workaround, avoid using the cmd=test option in the nbmember.cgi script to minimize the risk of exploitation.

Exploit

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2004-2732

Affected Products

Netbilling

References · 7

• 🔥 http://securityfocus.com/bid/11504 · Exploit
• 🔥 https://exploit-db.com/exploits/24700 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2004-2732 · Security Note
• http://osvdb.org/10902 · Note
• http://securitytracker.com/id?1011881 · Note
• http://web.archive.org/web/20041106200147/http://it-helpnet.de/bugless/bugs.php?mode=show&id=8&SID= · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/17865 · Note