PT-2006-6750 · Unknown · Monkey Boards

Jesper Jurcenoks · Published 2006-11-28 · Updated 2018-10-17 · CVE-2006-6113

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Monkey Boards version 0.3.5

Description The issue allows remote attackers to obtain sensitive information via direct requests to API endpoints such as "include/admin auth.inc.php" and "include/engine/class.compiler.php". This occurs because these endpoints reveal the full path in an error message. It is noted that this issue only constitutes an exposure if the administrator has changed the default script path.

Recommendations For Monkey Boards version 0.3.5, consider restricting access to the "include/admin auth.inc.php" and "include/engine/class.compiler.php" endpoints to minimize the risk of exploitation. Additionally, administrators should review their script path configurations to ensure they are using the default settings, thereby reducing the exposure risk.

Exploit

Fix

Related Identifiers

CVE-2006-6113

Affected Products

Monkey Boards

References · 7

• 🔥 http://netvigilance.com/advisory0009 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2006-6113 · Security Note
• http://osvdb.org/30683 · Note
• http://osvdb.org/30684 · Note
• http://sourceforge.net/tracker/index.php?func=detail&aid=1603389&group_id=165094&atid=834302 · Note
• http://lists.grok.org.uk/pipermail/full-disclosure/2006-November/050969.html · Note
• http://securityfocus.com/archive/1/452994/100/0/threaded · Note