PT-2007-1856 · Postnuke · Postnuke

Published 2007-01-19 · Updated 2008-11-13 · CVE-2007-0385

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions: PostNuke version 0.764

Description: The issue in PostNuke allows remote attackers to obtain sensitive information, specifically the full path, via unvalidated output in the FAQ section, possibly involving an undefined id cat variable in FAQ/index.php.

Recommendations: For PostNuke version 0.764, consider validating the output in the FAQ section to prevent the disclosure of sensitive information, and define the id cat variable to prevent its undefined use.

Fix

Related Identifiers

CVE-2007-0385

Affected Products

Postnuke

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2007-0385 · Security Note
• http://hackers.ir/advisories/festival.txt · Note
• http://noc.postnuke.com/plugins/scmsvn/viewcvs.php/trunk/Historic/PostNuke7x/html/modules/FAQ/index.php?root=postnuke&r1=20350&r2=20911 · Note
• http://noc.postnuke.com/plugins/scmsvn/viewcvs.php/trunk/Historic/PostNuke7x/html/modules/?root=postnuke · Note
• http://archives.neohapsis.com/archives/fulldisclosure/2007-01/0355.html · Note
• http://osvdb.org/35472 · Note