PT-2006-1472 · Note A Day · Note-A-Day Weblog

Published 2006-01-25 · Updated 2017-07-20 · CVE-2006-0404

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Note-A-Day Weblog version 2.2

Description The issue allows remote attackers to obtain sensitive information due to insufficient access control of sensitive data stored under the web document root. This can be achieved via a direct request to the "archive/.phpass-admin" endpoint, which contains encrypted passwords.

Recommendations For Note-A-Day Weblog version 2.2, restrict access to the "archive/.phpass-admin" endpoint to minimize the risk of exploitation. Consider implementing proper access controls for sensitive data stored under the web document root.

Exploit

Fix

Related Identifiers

CVE-2006-0404

Affected Products

Note-A-Day Weblog

References · 9

• 🔥 http://evuln.com/vulns/44/summary.html · Exploit
• http://secunia.com/advisories/18566 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2006-0404 · Security Note
• http://osvdb.org/22699 · Note
• http://securitytracker.com/id?1015539 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/24270 · Note
• http://archives.neohapsis.com/archives/bugtraq/2006-01/0389.html · Note
• http://securityreason.com/securityalert/371 · Note
• http://vupen.com/english/advisories/2006/0299 · Note