PT-2007-4353 · Cactushop · Cactushop

Published 2007-06-06 · Updated 2018-10-16 · CVE-2007-3061

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions: Cactushop versions 6 and earlier

Description: The issue allows remote attackers to download a database via a direct request for files such as cactushop6.mdb or cactushop5.mdb due to insufficient access control. This is because sensitive information is stored under the web root.

Recommendations: For Cactushop versions 6 and earlier, restrict access to the database files cactushop6.mdb and cactushop5.mdb to prevent unauthorized downloads. Consider implementing proper access controls for sensitive information stored under the web root.

Exploit

Fix

Weakness Enumeration

CWE-255

Related Identifiers

CVE-2007-3061

Affected Products

Cactushop

References · 8

• 🔥 https://exploit-db.com/exploits/10686 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2007-3061 · Security Note
• http://securityreason.com/securityalert/2780 · Note
• http://osvdb.org/42052 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3061 · Note
• http://osvdb.org/42053 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/34706 · Note
• http://securityfocus.com/archive/1/470439/100/0/threaded · Note