PT-2008-1788 · Snitz · Snitz Forums 2000

Published 2008-01-08 · Updated 2018-10-15 · CVE-2008-0135

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Snitz Forums 2000 versions 3.4.06 and earlier

Description The issue allows remote attackers to download a database due to insufficient access control of sensitive information stored under the web root. This can be achieved via a direct request for the database file.

Recommendations For Snitz Forums 2000 versions 3.4.06 and earlier, restrict access to the forum/snitz forums 2000.mdb file to prevent unauthorized downloads. Consider moving sensitive files outside of the web root or implementing proper access controls to mitigate the risk.

Exploit

Fix

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2008-0135

Affected Products

Snitz Forums 2000

References · 6

• 🔥 https://exploit-db.com/exploits/10639 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2008-0135 · Security Note
• http://hackerscenter.com/archive/view.asp?id=28145 · Note
• http://packetstormsecurity.org/0801-exploits/snitz-multi.txt · Note
• http://securityfocus.com/archive/1/485894/100/200/threaded · Note
• http://securityfocus.com/archive/1/485836/100/200/threaded · Note