PT-2010-1257 · Siteengine · Siteengine

Xy7 · Published 2010-12-01 · Updated 2018-10-11 · CVE-2008-7268

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions SiteEngine versions 5.x

Description The issue allows remote attackers to obtain system information. This is achieved by setting the action parameter to php info in the "misc.php" endpoint.

Recommendations For SiteEngine versions 5.x, consider restricting access to the "misc.php" endpoint or disabling the phpinfo function to minimize the risk of exploitation.

Exploit

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2008-7268

Affected Products

Siteengine

References · 5

• 🔥 https://exploit-db.com/exploits/6823 · Exploit
• http://secunia.com/advisories/32404 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2008-7268 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/46180 · Note
• http://securityfocus.com/archive/1/497747/100/0/threaded · Note