ClearBudget Invalid '.htaccess' Unauthorized Access Vulnerability
BID:33643
Info
ClearBudget Invalid '.htaccess' Unauthorized Access Vulnerability
| Bugtraq ID: | 33643 |
| Class: | Design Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Feb 05 2009 12:00AM |
| Updated: | Mar 03 2009 09:06PM |
| Credit: | Room-Hacker |
| Vulnerable: |
ClearBudget ClearBudget 0.6.1 |
| Not Vulnerable: |
ClearBudget ClearBudget 0.7.1 |
Discussion
ClearBudget Invalid '.htaccess' Unauthorized Access Vulnerability
ClearBudget is prone to an unauthorized-access vulnerability because it fails to properly restrict access to certain directories.
An attacker can exploit this vulnerability to gain access to database contents. Information harvested can lead to further attacks.
ClearBudget 0.6.1 is vulnerable; other versions may also be affected.
ClearBudget is prone to an unauthorized-access vulnerability because it fails to properly restrict access to certain directories.
An attacker can exploit this vulnerability to gain access to database contents. Information harvested can lead to further attacks.
ClearBudget 0.6.1 is vulnerable; other versions may also be affected.
Exploit / POC
ClearBudget Invalid '.htaccess' Unauthorized Access Vulnerability
Attackers may exploit this issue via a browser.
The following example URI is available:
http://www.example.com/db/budget.slite
Attackers may exploit this issue via a browser.
The following example URI is available:
http://www.example.com/db/budget.slite
Solution / Fix
ClearBudget Invalid '.htaccess' Unauthorized Access Vulnerability
Solution:
The vendor has released an update. Please see the references for more information.
Solution:
The vendor has released an update. Please see the references for more information.
References
ClearBudget Invalid '.htaccess' Unauthorized Access Vulnerability
References:
References:
- ClearBudget Homepage (ClearBudget)