Note-A-Day Weblog 'archive/.phpass-admin'信息泄露漏洞

QQ空间 新浪微博 微信 QQ facebook twitter
漏洞ID 1196273 漏洞类型 未知
发布时间 2006-01-24 更新时间 2006-01-24
CVE编号 CVE-2006-0404 CNNVD-ID CNNVD-200601-303
漏洞平台 N/A CVSS评分 5.0
|漏洞来源
https://www.securityfocus.com/bid/88521
https://cxsecurity.com/issue/WLB-2006010058
http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-200601-303
|漏洞详情
Note-A-DayWeblog2.2将敏感数据存储在Web文档根目录下,但没有充分的访问控制,这可让远程攻击者通过直接请求包含加密参数的archive/.phpass-admin获取敏感信息。
|漏洞EXP
New eVuln Advisory:
Note-A-Day Weblog Sensitive Information Disclosure
http://evuln.com/vulns/44/summary.html

--------------------Summary----------------

Software: Note-A-Day
Sowtware's Web Site: http://noteaday.com/
Versions: 2.1
Critical Level: Moderate
Type: Sensitive Information Disclosure
Class: Remote
Status: Unpatched
Exploit: Available
Solution: Not Available
Discovered by: Aliaksandr Hartsuyeu (eVuln.com)
eVuln ID: EV0044

-----------------Description---------------
Directory "archive" is not protected by htaccess in default installiation. This can be used to retrieve registered user's information including encrypted passwords.

--------------Exploit----------------------
Available at: http://evuln.com/vulns/44/exploit.html

--------------Solution---------------------
No Patch available.

--------------Credit-----------------------
Discovered by: Aliaksandr Hartsuyeu (eVuln.com)
|受影响的产品
Mike Macgirvin Note-A-Day Weblog 2.2
|参考资料

来源:XF
名称:noteaday-archive-information-disclosure(24270)
链接:http://xforce.iss.net/xforce/xfdb/24270
来源:VUPEN
名称:ADV-2006-0299
链接:http://www.frsirt.com/english/advisories/2006/0299
来源:SECUNIA
名称:18566
链接:http://secunia.com/advisories/18566
来源:MISC
链接:http://evuln.com/vulns/44/summary.html
来源:OSVDB
名称:22699
链接:http://www.osvdb.org/22699
来源:SECTRACK
名称:1015539
链接:http://securitytracker.com/id?1015539
来源:SREASON
名称:371
链接:http://securityreason.com/securityalert/371
来源:BUGTRAQ
名称:20060122[eVuln]Note-A-DayWeblogSensitiveInformationDisclosure
链接:http://archives.neohapsis.com/archives/bugtraq/2006-01/0389.html