PT-2005-4667 · Freeguppy · Guppy

Retrogod · Published 2005-11-30 · Updated 2018-10-19 · CVE-2005-3927

Positive Technologies (AI Summary)

CVSS v2.0

6.4

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions GuppY versions 4.5.9 and earlier

Description The issue allows remote attackers to read and include arbitrary files. This can be achieved via the meskin parameter to admin/editorTypetool.php, or the lng parameter to the scripts archbatch.php, dbbatch.php, and nwlmail.php in the admin/inc directory.

Recommendations For GuppY versions 4.5.9 and earlier, as a temporary workaround, consider restricting access to the admin/editorTypetool.php, archbatch.php, dbbatch.php, and nwlmail.php scripts until a patch is available. Avoid using the meskin and lng parameters in the affected scripts until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this issue.

Exploit

Fix

Related Identifiers

CVE-2005-3927

Affected Products

Guppy

References · 14

• 🔥 http://rgod.altervista.org/guppy459_xpl.html · Exploit
• 🔥 https://exploit-db.com/exploits/26641 · Exploit
• 🔥 https://exploit-db.com/exploits/26642 · Exploit
• 🔥 http://securityfocus.com/bid/15610 · Exploit
• 🔥 http://securitytracker.com/id?1015279 · Exploit
• 🔥 https://exploit-db.com/exploits/26640 · Exploit
• 🔥 https://exploit-db.com/exploits/26639 · Exploit
• http://secunia.com/advisories/17790 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2005-3927 · Security Note
• http://vupen.com/english/advisories/2005/2635 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/23319 · Note
• http://securityreason.com/securityalert/212 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-3927 · Note
• http://securityfocus.com/archive/1/417899/100/0/threaded · Note