PT-2007-2845 · Guppy · Guppy

Published 2007-03-14 · Updated 2018-10-16 · CVE-2007-1451

Positive Technologies (AI Summary)

CVSS v2.0

6.4

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:P/A:P

Name of the Vulnerable Software and Affected Versions GuppY version 4.0

Description The issue allows remote attackers to delete arbitrary files. This can be achieved by making a direct request to the install/install.php endpoint, then selecting "Installation propre" which leads to cleanup.php, and finally selecting "Suppression des fichiers d'installation" which leads to delete.php.

Recommendations For GuppY version 4.0, consider restricting access to the install/install.php endpoint and the subsequent cleanup.php and delete.php scripts to prevent unauthorized file deletion. As a temporary workaround, consider disabling the delete functionality in delete.php until a patch is available.

Exploit

Fix

Related Identifiers

CVE-2007-1451

Affected Products

Guppy

References · 6

• 🔥 http://forums.avenir-geopolitique.net/viewtopic.php?t=2728 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2007-1451 · Security Note
• http://osvdb.org/35085 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-1451 · Note
• http://securityfocus.com/archive/1/462584/100/0/threaded · Note
• http://securityreason.com/securityalert/2433 · Note