PT-2006-3312 · Sap · E-Business Designer

Published 2006-05-12 · Updated 2018-10-18 · CVE-2006-2347

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions E-Business Designer (eBD) versions 3.1.4 and earlier

Description The issue allows remote attackers to obtain the full path of the web server by using specific characters, such as '', and possibly other invalid values, in the id parameter to "form grupo.html", or by making requests to the "archivos/" and "files/" directories. This might be related to SQL injection.

Recommendations For E-Business Designer (eBD) versions 3.1.4 and earlier, consider restricting access to the "archivos/" and "files/" directories and validating the id parameter in "form grupo.html" to prevent exploitation until a fix is available. Avoid using invalid values in the id parameter to minimize the risk of path disclosure.

Fix

Related Identifiers

CVE-2006-2347

Affected Products

E-Business Designer

References · 8

• http://lists.grok.org.uk/pipermail/full-disclosure/2006-May/045980.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2006-2347 · Security Note
• http://secunia.com/advisories/20071 · Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/26476 · Note
• http://securityreason.com/securityalert/891 · Note
• http://vupen.com/english/advisories/2006/1784 · Note
• http://securityfocus.com/archive/1/433807/100/0/threaded · Note
• http://securityfocus.com/bid/17933 · Note