PT-2006-3550 · Hyperstop+1 · Hyperstop Webhost Directory+1

Luny · Published 2006-05-26 · Updated 2018-10-18 · CVE-2006-2617

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions AlstraSoft Web Host Directory version 1.2 HyperStop WebHost Directory version 1.2

Description The issue allows remote attackers to obtain the installation path via an invalid entry in the Username field on the login page, which causes the path to be displayed in an SQL error. This might be a result of SQL injection.

Recommendations For AlstraSoft Web Host Directory version 1.2, consider validating user input in the Username field to prevent SQL errors that reveal sensitive information. For HyperStop WebHost Directory version 1.2, restrict access to the login page until a proper fix is applied to handle invalid input without disclosing the installation path.

Fix

Related Identifiers

CVE-2006-2617

Affected Products

Alstrasoft Web Host Directory

Hyperstop Webhost Directory

References · 10

• https://nvd.nist.gov/vuln/detail/CVE-2006-2617 · Security Note
• http://secunia.com/advisories/20276 · Vendor Advisory
• http://secunia.com/advisories/20278 · Vendor Advisory
• http://securityfocus.com/archive/1/434912/100/0/threaded · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/26656 · Note
• http://sitepoint.com/forums/showthread.php?t=311969 · Note
• http://securityreason.com/securityalert/955 · Note
• http://vupen.com/english/advisories/2006/1972 · Note
• http://vupen.com/english/advisories/2006/1973 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/26661 · Note