PT-2010-5477 · Dynpg · Dynpg Cms

Published 2010-12-04 · Updated 2021-03-25 · CVE-2010-4401

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions DynPG CMS version 4.2.0

Description The issue allows remote attackers to obtain sensitive information via a direct request to languages.inc.php, which reveals the installation path in an error message.

Recommendations For DynPG CMS version 4.2.0, consider restricting access to the languages.inc.php file until a patch is available. As a temporary workaround, modify the error handling mechanism to prevent the disclosure of sensitive information, such as the installation path.

Exploit

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2010-4401

Affected Products

Dynpg Cms

References · 7

• 🔥 http://packetstormsecurity.org/files/view/96230/dynpg-lfisqldisclose.txt · Exploit
• 🔥 https://exploit-db.com/exploits/15646 · Exploit
• 🔥 http://htbridge.ch/advisory/path_disclosure_in_dynpg.html · Exploit
• 🔥 http://exploit-db.com/exploits/15646 · Exploit
• http://dynpg.org/cms-freeware_en.php?t=DynPG+Update+4.2.1+Security+Update&read_article=226 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2010-4401 · Security Note
• http://osvdb.org/69632 · Note