PT-2006-3482 · Destiney · Destiney Links Script

Luny · Published 2006-05-22 · Updated 2018-10-18 · CVE-2006-2535

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Destiney Links Script version 2.1.2

Description The issue allows remote attackers to obtain the installation path via an invalid show parameter referencing a non-existent file in index.php, which reveals the path in the resulting error message. This might be a symptom of a more serious issue, such as directory traversal.

Recommendations For Destiney Links Script version 2.1.2, consider restricting access to the index.php file or validating the show parameter to prevent the disclosure of the installation path. As a temporary workaround, restrict the use of the show parameter in index.php to minimize the risk of path disclosure.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2006-2535

Affected Products

Destiney Links Script

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2006-2535 · Security Note
• http://secunia.com/advisories/20248 · Vendor Advisory
• http://vupen.com/english/advisories/2006/1933 · Vendor Advisory
• http://securityreason.com/securityalert/937 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/26611 · Note
• http://securityfocus.com/archive/1/434692/100/0/threaded · Note