PT-2009-6586 · Deluxebb · Deluxebb

Cp77Fk4R · Published 2009-12-30 · Updated 2017-08-17 · CVE-2009-4465

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions DeluxeBB version 1.3

Description The issue allows remote attackers to obtain sensitive information, including user and configuration data, log files, and gain administrative access. This is possible due to the storage of sensitive information under the web root with insufficient access control. Attackers can access scripts in various directories, such as templates/, images/, logs/, wysiwyg/, docs/, classes/, lang/, and settings/, via a direct request. Specifically, attackers can target directories like templates/deluxe/admincp/, templates/corporate/admincp/, and templates/blue/admincp/, as well as files like logs/cp.php.

Recommendations For DeluxeBB version 1.3, consider restricting direct access to sensitive directories and files, such as templates/, images/, logs/, wysiwyg/, docs/, classes/, lang/, and settings/, to prevent unauthorized access. As a temporary workaround, restrict access to the logs/ directory and files like logs/cp.php to minimize the risk of exploitation. Additionally, limit access to administrative scripts in templates/deluxe/admincp/, templates/corporate/admincp/, and templates/blue/admincp/ until a proper fix is applied.

Exploit

Fix

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2009-4465

Affected Products

Deluxebb

References · 8

• 🔥 http://exploit-db.com/exploits/10598 · Exploit
• 🔥 https://exploit-db.com/exploits/10598 · Exploit
• 🔥 http://securityfocus.com/bid/37448 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2009-4465 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/54978 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/54977 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/54975 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-4465 · Note