PT-2007-4089 · Alstrasoft · Alstrasoft Live Support

Blackhawk · Published 2007-05-21 · Updated 2017-10-11 · CVE-2007-2775

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions AlstraSoft Live Support version 1.21

Description The issue allows remote attackers to obtain administrative access. This is possible because when administrative credentials are missing, the software sends a redirect to the web browser but does not exit. Attackers can exploit this by making a direct request to the "admin/managesettings.php" endpoint.

Recommendations For AlstraSoft Live Support version 1.21, consider restricting access to the "admin/managesettings.php" endpoint until a fix is available. As a temporary workaround, ensure that administrative credentials are always provided to prevent unauthorized access.

Exploit

Fix

Related Identifiers

CVE-2007-2775

Affected Products

Alstrasoft Live Support

References · 7

• 🔥 https://exploit-db.com/exploits/3957 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2007-2775 · Security Note
• http://secunia.com/advisories/25337 · Note
• http://osvdb.org/36638 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/34395 · Note
• http://itablackhawk.altervista.org/exploit/alsoft_exploit_pack · Note
• http://securityfocus.com/bid/24073 · Note