netRisk 'change_submit.php' Password Information Disclosure Vulnerability

Bugtraq ID:	27150
Class:	Design Error
CVE:	CVE-2008-7155
Remote:	Yes
Local:	No
Published:	Jan 05 2008 12:00AM
Updated:	May 07 2015 05:33PM
Credit:	Cod3rZ is credited with discovering this issue.
Vulnerable:	phprisk.org netRisk 1.9.7
Not Vulnerable:

netRisk 'change_submit.php' Password Information Disclosure Vulnerability

netRisk is prone to an information-disclosure vulnerability because it fails to sanitize user-supplied input before using it to provide authentication credentials.

Attackers can exploit this issue to gain unauthorized access to the affected application and then manipulate or delete sensitive information.

netRisk 'change_submit.php' Password Information Disclosure Vulnerability

To exploit this issue, attackers can use readily available commands or network utilities.

The following exploit code is available:

• /data/vulnerabilities/exploits/27150.pl

netRisk 'change_submit.php' Password Information Disclosure Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

netRisk 'change_submit.php' Password Information Disclosure Vulnerability

References:

• netRisk Homepage (phprisk.org)