PT-2007-1423 · Unknown · Call Center

Published 2007-03-07 · Updated 2018-10-16 · CVE-2006-7145

Positive Technologies (AI Summary)

CVSS v2.0

5.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Call Center Software versions 0.93 and earlier

Description The issue allows remote attackers to obtain sensitive information, such as account passwords, by modifying the user id parameter in the "edit user.php" endpoint.

Recommendations For Call Center Software versions 0.93 and earlier, avoid using the user id parameter in the edit user.php endpoint until the issue is resolved. Restrict access to the edit user.php endpoint to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this issue.

Exploit

Fix

Related Identifiers

CVE-2006-7145

Affected Products

Call Center

References · 8

• 🔥 http://archives.neohapsis.com/archives/fulldisclosure/2006-10/0217.html · Exploit
• 🔥 http://mayhemiclabs.com/advisories/MHL-2006-002.txt · Exploit
• http://securityfocus.com/bid/20474 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2006-7145 · Security Note
• http://secunia.com/advisories/22365 · Vendor Advisory
• http://securityfocus.com/archive/1/448423/100/0/threaded · Note
• http://securityreason.com/securityalert/2389 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/29486 · Note