PT-2006-4783 · X Atrix · X Atrix Xguestbook

Dicomdk · Published 2006-07-31 · Updated 2018-10-17 · CVE-2006-3937

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions x atrix xGuestBook version 1.02

Description The issue allows remote attackers to obtain sensitive information via a request without certain parameters, which reveals the installation path in an error message. Specifically, the absence of the user, mail, p, or url parameter in a request to the 'post.php' endpoint triggers this behavior.

Recommendations For x atrix xGuestBook version 1.02, consider restricting access to the 'post.php' endpoint to minimize the risk of exploitation, or ensure that all requests to this endpoint include at least one of the required parameters (user, mail, p, or url) to prevent the disclosure of sensitive information.

Fix

Related Identifiers

CVE-2006-3937

Affected Products

X Atrix Xguestbook

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2006-3937 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/27979 · Note
• http://securityreason.com/securityalert/1304 · Note
• http://securityfocus.com/archive/1/441170/100/0/threaded · Note