Modular Site Management System Ver.asp Information Disclosure Vulnerability

Bugtraq ID:	10208
Class:	Design Error
CVE:
Remote:	Yes
Local:	No
Published:	Apr 23 2004 12:00AM
Updated:	Apr 23 2004 12:00AM
Credit:	Discovery is credited to CyberTalon.
Vulnerable:	PW New Media Network Modular Site Management System 0.2.1
Not Vulnerable:

Modular Site Management System Ver.asp Information Disclosure Vulnerability

It has been reported that Modular Site Management System may be prone to an information disclosure issue that could allow an attacker to gain access to a server's configuration information.

MSMS version 0.2.1 is reported to be affected by this issue, however, it is possible that other versions are vulnerable as well.

Modular Site Management System Ver.asp Information Disclosure Vulnerability

No exploit is required.

The following proof of concept has been provided:
http://www.example.com/msms/ver.asp

Modular Site Management System Ver.asp Information Disclosure Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

Modular Site Management System Ver.asp Information Disclosure Vulnerability

References:

• Modular Site Management System (MSMS) 'ver.asp' May Disclose System Information (SecurityTracker)
  
• Modular Site Management System Product Page (PW New Media Network)