PT-2008-1623 · Unknown · 2Z Project

Alexandr Polyakov + 1 · Published 2008-01-04 · Updated 2018-10-15 · CVE-2007-6660

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions 2z project version 0.9.6.1

Description The issue allows remote attackers to obtain sensitive information. This can be achieved through a request to index.php with an invalid template or a request to the default URI with certain year and month parameters. The vulnerability reveals the path in various error messages.

Recommendations For version 0.9.6.1, consider restricting access to the index.php file and limiting the input for year and month parameters to prevent exploitation until a patch is available. As a temporary workaround, avoid using invalid templates in requests to index.php and restrict the use of certain year and month parameters in requests to the default URI.

Exploit

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2007-6660

Affected Products

2Z Project

References · 5

• 🔥 http://securityfocus.com/bid/27057 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2007-6660 · Security Note
• http://securityfocus.com/archive/1/485590/100/0/threaded · Note
• http://securityreason.com/securityalert/3514 · Note
• http://2z-project.ru/forum/viewtopic.php?pid=8309 · Note