PT-2012-5034 · Gekko · Gekko

Gjoko Krstic · Published 2012-07-03 · Updated 2012-07-17 · CVE-2012-3838

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Gekko versions prior to 1.2.0

Description The issue allows remote attackers to obtain the installation path via a direct request to specific PHP files. This can be achieved by accessing the following API endpoints: "admin/templates/babygekko/index.php" or "templates/html5demo/index.php".

Recommendations For versions prior to 1.2.0, update to version 1.2.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the vulnerable API endpoints "admin/templates/babygekko/index.php" and "templates/html5demo/index.php" until a patch is available.

Exploit

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2012-3838

Affected Products

Gekko

References · 5

• 🔥 http://exploit-db.com/exploits/18827 · Exploit
• 🔥 http://zeroscience.mk/en/vulnerabilities/ZSL-2012-5086.php · Exploit
• 🔥 https://exploit-db.com/exploits/18827 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2012-3838 · Security Note
• http://babygekko.com/site/news/general/baby-gekko-v1-2-0-released-with-3rd-party-independent-security-testing-performed-by-zero-science-lab.html · Note