PT-2005-2565 · Unknown · Quick.Forum

Lostmon · Published 2005-05-14 · Updated 2008-09-05 · CVE-2005-1586

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Quick.Forum version 2.1.6

Description The issue allows remote attackers to obtain potentially sensitive information, including usernames, banned IP addresses, censored words, and backups, by making a direct request to certain files. Specifically, attackers can access files such as db/users.txt, db/banList.txt, db/censureWords.txt, or backup files.

Recommendations For Quick.Forum version 2.1.6, consider moving sensitive files outside of the web document root to prevent direct access. As a temporary workaround, restrict access to the db directory and backup files to minimize the risk of exploitation.

Fix

Related Identifiers

CVE-2005-1586

Affected Products

Quick.Forum

References · 5

• http://osvdb.org/16329 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2005-1586 · Security Note
• http://secunia.com/advisories/15200 · Vendor Advisory
• http://osvdb.org/16328 · Vendor Advisory
• http://lostmon.blogspot.com/2005/05/quickforum-topic-field-xss-and-page.html · Vendor Advisory