PT-2009-1332 · Myphpscripts · Myphpscripts Login Session

Osirys · Published 2009-01-06 · Updated 2017-09-29 · CVE-2008-5855

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions myPHPscripts Login Session version 2.0

Description The issue allows remote attackers to discover sensitive information, including usernames, e-mail addresses, and password hashes, by making a direct request for the users.txt file. This is due to insufficient access control for sensitive information stored under the web root.

Recommendations For myPHPscripts Login Session version 2.0, consider restricting access to the users.txt file to prevent unauthorized disclosure of sensitive information. As a temporary workaround, restrict access to the web root directory to minimize the risk of exploitation.

Exploit

Fix

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2008-5855

Affected Products

Myphpscripts Login Session

References · 5

• 🔥 https://exploit-db.com/exploits/7526 · Exploit
• http://secunia.com/advisories/33253 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2008-5855 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/47502 · Note
• http://securityreason.com/securityalert/4873 · Note