Jax PHP Scripts Multiple Remote Information Disclosure Vulnerabilities
BID:14482
Info
Jax PHP Scripts Multiple Remote Information Disclosure Vulnerabilities
| Bugtraq ID: | 14482 |
| Class: | Access Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Aug 05 2005 12:00AM |
| Updated: | Aug 05 2005 12:00AM |
| Credit: | Lostmon <[email protected]> is credited with the discovery of these vulnerabilities. |
| Vulnerable: |
Jax Scripts Jax Petitionbook 3.31 Jax Scripts Jax Newsletter 2.14 Jax Scripts Jax LinkLists 1.0 Jax Scripts Jax Guestbook 3.31 Jax Scripts Jax DWT Editor 1.0 Jax Scripts Jax Calendar 1.34 |
| Not Vulnerable: | |
Discussion
Jax PHP Scripts Multiple Remote Information Disclosure Vulnerabilities
Jax PHP Scripts are prone to multiple remote information disclosure vulnerabilities.
These issues are due to a failure in the application to perform proper access validation before granting access to sensitive and privileged information.
An attacker can exploit these vulnerabilities to obtain the IP's of either banned users, or users that have made some contribution to the Web site. Such contributions include users who have signed petitions, sent messages using the formmail, contributed messages and users who have suggested a link.
Jax PHP Scripts are prone to multiple remote information disclosure vulnerabilities.
These issues are due to a failure in the application to perform proper access validation before granting access to sensitive and privileged information.
An attacker can exploit these vulnerabilities to obtain the IP's of either banned users, or users that have made some contribution to the Web site. Such contributions include users who have signed petitions, sent messages using the formmail, contributed messages and users who have suggested a link.
Exploit / POC
Jax PHP Scripts Multiple Remote Information Disclosure Vulnerabilities
No exploit is required.
The following proof of concept URI are available:
http://www.example.com/guestbook/guestbook
http://www.example.com/guestbook/guestbook_ips2block
http://www.example.com/guestbook/ips2block
http://www.example.com/guestbook/formmailer/logfile.csv
http://www.example.com/petitionbook/formmailer.log
http://www.example.com/petitionbook/ips2block
http://www.example.com/petitionbook/petitionbook
http://www.example.com/linklists/suggestions.csv
http://www.example.com/newsletter/logs/jnl_records
No exploit is required.
The following proof of concept URI are available:
http://www.example.com/guestbook/guestbook
http://www.example.com/guestbook/guestbook_ips2block
http://www.example.com/guestbook/ips2block
http://www.example.com/guestbook/formmailer/logfile.csv
http://www.example.com/petitionbook/formmailer.log
http://www.example.com/petitionbook/ips2block
http://www.example.com/petitionbook/petitionbook
http://www.example.com/linklists/suggestions.csv
http://www.example.com/newsletter/logs/jnl_records
Solution / Fix
Jax PHP Scripts Multiple Remote Information Disclosure Vulnerabilities
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
References
Jax PHP Scripts Multiple Remote Information Disclosure Vulnerabilities
References:
References:
- Jax PHP Scripts multiple vulnerabilities (Lostmon
- Jax Scripts Homepage (Jax Scripts)