PT-2007-6224 · Simpgb · Simpgb

Jesper Jurcenoks · Published 2007-09-27 · Updated 2018-10-15 · CVE-2007-5129

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions SimpGB version 1.46.02

Description The issue allows remote attackers to obtain sensitive configuration information and download arbitrary files due to insufficient access control. This can be achieved by making a direct request for specific files, such as admin/cfginfo.php for configuration information, and other .inc files, for example, admin/includes/dbtables.inc.

Recommendations For SimpGB version 1.46.02, consider restricting direct access to sensitive files such as admin/cfginfo.php and .inc files under the admin/includes directory until a proper fix is available. As a temporary workaround, restrict access to the admin directory to minimize the risk of exploitation.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2007-5129

Affected Products

Simpgb

References · 11

• http://forum.boesch-it.de/viewtopic.php?t=2790 · Patch
• http://secunia.com/advisories/26974 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2007-5129 · Security Note
• http://osvdb.org/40613 · Note
• http://securityfocus.com/archive/1/480590/100/0/threaded · Note
• http://osvdb.org/40612 · Note
• http://netvigilance.com/advisory0065 · Note
• http://securityfocus.com/archive/1/480592/100/0/threaded · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/36777 · Note
• http://netvigilance.com/advisory0066 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/36776 · Note