PT-2006-2087 · Kwik Pay · Kwik-Pay Payroll

Published 2006-03-07 · Updated 2024-08-07 · CVE-2006-1050

Positive Technologies (AI Summary)

CVSS v2.0

2.1

Low

Base vector

AV:L/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Kwik-Pay Payroll version 4.2.20

Description The issue concerns the storage of the KwikPay.mdb database file with insecure permissions, potentially allowing local users to access sensitive information such as employment and payment data. The vendor has disputed this, stating that the KwikPay.mdb file is a template and does not contain sensitive user information. Additionally, when a user payroll database is opened, the encryption of the database is checked, and if it is not encrypted, the user is prompted to encrypt it.

Recommendations For Kwik-Pay Payroll version 4.2.20, consider encrypting the database to protect sensitive information. Ensure that the database encryption is enabled when creating or opening user payroll databases. As a temporary workaround, restrict access to the KwikPay.mdb file to minimize the risk of exploitation.

Fix

Related Identifiers

CVE-2006-1050

Affected Products

Kwik-Pay Payroll

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2006-1050 · Security Note
• http://secunia.com/advisories/19075 · Vendor Advisory
• https://t.me/cvenotify/89759 · Telegram Post
• http://osvdb.org/23617 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/25114 · Note