PT-2008-6812 · Unknown · Simple Text-File Login Script

Osirys · Published 2008-12-30 · Updated 2017-09-29 · CVE-2008-5762

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Simple Text-File Login Script (SiTeFiLo) version 1.0.6

Description The issue allows remote attackers to download the database file containing the password via a direct request for slog users.txt, due to insufficient access control of sensitive information stored under the web root.

Recommendations For Simple Text-File Login Script (SiTeFiLo) version 1.0.6, consider restricting access to the slog users.txt file to prevent unauthorized downloads, or relocate sensitive files outside of the web root to minimize the risk of exploitation.

Exploit

Fix

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2008-5762

Affected Products

Simple Text-File Login Script

References · 5

• 🔥 https://exploit-db.com/exploits/7444 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2008-5762 · Security Note
• http://secunia.com/advisories/33110 · Vendor Advisory
• http://securityreason.com/securityalert/4847 · Note
• http://osvdb.org/50712 · Note