PT-2007-5454 · Ezphotosales · Ezphotosales

Published 2007-08-08 · Updated 2018-10-15 · CVE-2007-4261

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions EZPhotoSales versions 1.9.3 and earlier

Description The issue allows remote attackers to download sensitive files due to insufficient access control. This includes downloading a file with cleartext passwords via a direct request for "OnlineViewing/data/galleries.txt" or a file with username and password hashes via a direct request for "OnlineViewing/configuration/config.dat". The latter can be exploited for administrative access because authentication uses the username hash in the ConfigLogin parameter and the password hash in the ConfigPassword parameter.

Recommendations For EZPhotoSales versions 1.9.3 and earlier, restrict access to the "OnlineViewing/data/galleries.txt" and "OnlineViewing/configuration/config.dat" files to prevent unauthorized downloads. Additionally, consider modifying the authentication mechanism to require knowledge of cleartext values or implement an alternative secure authentication method. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-255

Related Identifiers

CVE-2007-4261

Affected Products

Ezphotosales

References · 10

• https://nvd.nist.gov/vuln/detail/CVE-2007-4261 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/35840 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/35841 · Note
• http://informit.com/guides/content.asp?g=security&seqNum=268 · Note
• http://informit.com/guides/content.asp?g=security&seqNum=267 · Note
• http://securityfocus.com/bid/25323 · Note
• http://airscanner.com/security/07080601_ezphotosales.htm · Note
• http://secunia.com/advisories/26341 · Note
• http://securityreason.com/securityalert/2985 · Note
• http://securityfocus.com/archive/1/475678/100/0/threaded · Note