PT-2009-4533 · Mrcgiguy · Mrcgiguy The Ticket System

The G0Bl!N · Published 2009-06-16 · Updated 2017-09-29 · CVE-2009-2080

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions MRCGIGUY The Ticket System version 2.0

Description The issue allows remote attackers to obtain sensitive configuration information or change the administrator's password. This can be achieved by accessing the admin.php file, which does not properly restrict access. Specifically, attackers can obtain configuration information via the editconfig action or change the administrator's password via the id parameter in an editop action.

Recommendations For MRCGIGUY The Ticket System version 2.0, restrict access to the admin.php file to prevent unauthorized modifications and information disclosure. As a temporary workaround, consider disabling the editconfig and editop actions until a proper fix is applied. Additionally, restrict the use of the id parameter in the editop action to minimize the risk of password changes by unauthorized users.

Exploit

Fix

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2009-2080

Affected Products

Mrcgiguy The Ticket System

References · 4

• 🔥 https://exploit-db.com/exploits/8917 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2009-2080 · Security Note
• http://secunia.com/advisories/35350 · Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/51029 · Note