Sign-up

ID

VAR-200507-0076


CVE

CVE-2005-2169


TITLE

Quick&Dirty source.php Directory traversal vulnerability

Trust: 0.6

sources: CNNVD: CNNVD-200507-067

DESCRIPTION

Directory traversal vulnerability in source.php in Quick & Dirty PHPSource Printer 1.1 and earlier allows remote attackers to read arbitrary files via ".../...//" sequences in the file parameter, which are reduced to "../" when PHPSource Printer uses a regular expression to remove "../" sequences. Quick And Dirty Phpsource Printer is prone to a directory traversal vulnerability. ---------------------------------------------------------------------- Bist Du interessiert an einem neuen Job in IT-Sicherheit? Secunia hat zwei freie Stellen als Junior und Senior Spezialist in IT- Sicherheit: http://secunia.com/secunia_vacancies/ ---------------------------------------------------------------------- TITLE: Quick & Dirty PHPSource Printer Directory Traversal Vulnerability SECUNIA ADVISORY ID: SA15900 VERIFY ADVISORY: http://secunia.com/advisories/15900/ CRITICAL: Moderately critical IMPACT: Exposure of system information, Exposure of sensitive information WHERE: >From remote SOFTWARE: Quick & Dirty PHPSource Printer 1.x http://secunia.com/product/5323/ DESCRIPTION: Seth Alan Woolley has discovered a vulnerability in Quick & Dirty PHPSource Printer, which can be exploited by malicious people to gain knowledge of sensitive information. Input passed to the "file" parameter in "source.php" is not properly sanitised before being used. The vulnerability has been confirmed in version 1.0. Other versions may also be affected. SOLUTION: The vendor has released version 1.1, which does not properly fix the vulnerability. Edit the source code to ensure that input is properly verified. PROVIDED AND/OR DISCOVERED BY: Seth Alan Woolley ---------------------------------------------------------------------- About: This Advisory was delivered by Secunia as a free service to help everybody keeping their systems up to date against the latest vulnerabilities. Subscribe: http://secunia.com/secunia_security_advisories/ Definitions: (Criticality, Where etc.) http://secunia.com/about_secunia_advisories/ Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor. ---------------------------------------------------------------------- Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org ----------------------------------------------------------------------

Trust: 1.35

sources: NVD: CVE-2005-2169 // BID: 89728 // VULHUB: VHN-13378 // PACKETSTORM: 38452

AFFECTED PRODUCTS

vendor:kaf oseomodel:quick and dirty phpsource printerscope:eqversion:1.1

Trust: 1.6

vendor:kafmodel:oseo quick and dirty phpsource printerscope:eqversion:1.1

Trust: 0.3

sources: BID: 89728 // CNNVD: CNNVD-200507-067 // NVD: CVE-2005-2169

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2005-2169
value: MEDIUM

Trust: 1.0

CNNVD: CNNVD-200507-067
value: MEDIUM

Trust: 0.6

VULHUB: VHN-13378
value: MEDIUM

Trust: 0.1

nvd@nist.gov: CVE-2005-2169
severity: MEDIUM
baseScore: 5.0
vectorString: AV:N/AC:L/AU:N/C:P/I:N/A:N
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: 10.0
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.0

VULHUB: VHN-13378
severity: MEDIUM
baseScore: 5.0
vectorString: AV:N/AC:L/AU:N/C:P/I:N/A:N
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: 10.0
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

sources: VULHUB: VHN-13378 // CNNVD: CNNVD-200507-067 // NVD: CVE-2005-2169

PROBLEMTYPE DATA

problemtype:NVD-CWE-Other

Trust: 1.0

sources: NVD: CVE-2005-2169

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-200507-067

TYPE

path traversal

Trust: 0.6

sources: CNNVD: CNNVD-200507-067

EXTERNAL IDS

db:SECTRACKid:1014376

Trust: 2.0

db:NVDid:CVE-2005-2169

Trust: 2.0

db:SECUNIAid:15900

Trust: 1.8

db:CNNVDid:CNNVD-200507-067

Trust: 0.7

db:BIDid:89728

Trust: 0.4

db:VULHUBid:VHN-13378

Trust: 0.1

db:PACKETSTORMid:38452

Trust: 0.1

sources: VULHUB: VHN-13378 // BID: 89728 // PACKETSTORM: 38452 // CNNVD: CNNVD-200507-067 // NVD: CVE-2005-2169

REFERENCES

url:http://guff.szub.net/2005/07/04/quick-and-dirty-security/

Trust: 2.0

url:http://securitytracker.com/id?1014376

Trust: 2.0

url:http://secunia.com/advisories/15900

Trust: 1.7

url:http://secunia.com/secunia_security_advisories/

Trust: 0.1

url:http://secunia.com/product/5323/

Trust: 0.1

url:http://secunia.com/secunia_vacancies/

Trust: 0.1

url:http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org

Trust: 0.1

url:http://secunia.com/about_secunia_advisories/

Trust: 0.1

url:http://secunia.com/advisories/15900/

Trust: 0.1

sources: VULHUB: VHN-13378 // BID: 89728 // PACKETSTORM: 38452 // CNNVD: CNNVD-200507-067 // NVD: CVE-2005-2169

CREDITS

Unknown

Trust: 0.3

sources: BID: 89728

SOURCES

db:VULHUBid:VHN-13378
db:BIDid:89728
db:PACKETSTORMid:38452
db:CNNVDid:CNNVD-200507-067
db:NVDid:CVE-2005-2169

LAST UPDATE DATE

2024-08-14T15:40:52.574000+00:00


SOURCES UPDATE DATE

db:VULHUBid:VHN-13378date:2008-09-05T00:00:00
db:BIDid:89728date:2005-07-06T00:00:00
db:CNNVDid:CNNVD-200507-067date:2006-04-07T00:00:00
db:NVDid:CVE-2005-2169date:2008-09-05T20:51:04.163

SOURCES RELEASE DATE

db:VULHUBid:VHN-13378date:2005-07-06T00:00:00
db:BIDid:89728date:2005-07-06T00:00:00
db:PACKETSTORMid:38452date:2005-07-07T05:09:24
db:CNNVDid:CNNVD-200507-067date:2005-07-06T00:00:00
db:NVDid:CVE-2005-2169date:2005-07-06T04:00:00