PT-2017-14256 · Gideon Pine · Gpweb

Published 2017-12-18 · Updated 2019-10-03 · CVE-2017-15877

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions GPWeb version 8.4.61

Description The issue is related to insecure permissions in the db.php file, allowing remote attackers to access sensitive information, including passwords and user databases.

Recommendations For GPWeb version 8.4.61, update the permissions of the db.php file to restrict access and prevent unauthorized viewing of the password and user database.

Exploit

Fix

Incorrect Permission

Weakness Enumeration

CWE-732

Related Identifiers

CVE-2017-15877

Affected Products

Gpweb

References · 3

• 🔥 https://augustopereira.com.br/blog/seguranca-gpweb-8-4-61-multiplas-falhas-sqli-manipulacao-de-privilegios-uploads-sem-restricoes-exposicao-de-informacao-sensivel · Exploit
• https://osv.dev/vulnerability/CVE-2017-15877 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-15877 · Security Note