PT-2005-4402 · Phpadsnew · Phppgads+1

Toni Koivunen · Published 2005-11-17 · Updated 2017-07-11 · CVE-2005-3645

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions phpAdsNew and phpPgAds version 2.0.6 and earlier

Description The issue allows remote attackers to obtain sensitive information, including the application installation path, by making direct requests to certain files. This is possible due to the exposure of sensitive data when display errors is enabled. The affected files include "create.php", "lib-updates.inc.php", "lib-targetstats.inc.php", "lib-size.inc.php", "lib-misc-stats.inc.php", "lib-hourly-hosts.inc.php", "lib-hourly.inc.php", "lib-history.inc.php", and "graph-daily.php".

Recommendations For phpAdsNew and phpPgAds version 2.0.6 and earlier, consider disabling the display of errors to prevent the exposure of sensitive information. Restrict access to the mentioned files to minimize the risk of exploitation. Avoid using the affected files until a patch or fix is available. At the moment, there is no information about a newer version that contains a fix for this issue.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2005-3645

Affected Products

Phpadsnew

Phppgads

References · 19

• http://fitsec.com/advisories/FS-05-01.txt · Vendor Advisory
• http://vupen.com/english/advisories/2005/2380 · Vendor Advisory
• http://secunia.com/advisories/17464 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2005-3645 · Security Note
• http://osvdb.org/20738 · Note
• http://seclists.org/lists/bugtraq/2005/Nov/0189.html · Note
• http://osvdb.org/20735 · Note
• http://osvdb.org/20741 · Note
• http://osvdb.org/20742 · Note
• http://osvdb.org/20739 · Note
• http://sourceforge.net/project/shownotes.php?group_id=36679&release_id=370942 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-3645 · Note
• http://marc.info/?l=bugtraq&m=113165036315035&w=2 · Note
• http://securityreason.com/securityalert/171 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/23043 · Note