7.5

CVE-2007-4261

EZPhotoSales 1.9.3 and earlier stores sensitive information under the web root with insufficient access control, which allows remote attackers to download (1) a file containing cleartext passwords via a direct request for OnlineViewing/data/galleries.txt, or (2) a file containing username hashes and password hashes via a direct request for OnlineViewing/configuration/config.dat/.  NOTE: vector 2 can be leveraged for administrative access because authentication does not require knowledge of cleartext values, but instead uses the username hash in the ConfigLogin parameter and the password hash in the ConfigPassword parameter.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Ez Photo Sales ≫ Ez Photo Sales Version1.9.3
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 2.12% 0.795
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 7.5 10 6.4
AV:N/AC:L/Au:N/C:P/I:P/A:P
Es wurden noch keine Informationen zu CWE veröffentlicht.
http://secunia.com/advisories/26341
http://securityreason.com/securityalert/2985
http://www.airscanner.com/security/07080601_ezphotosales.htm
http://www.informit.com/guides/content.asp?g=security&seqNum=267
http://www.informit.com/guides/content.asp?g=security&seqNum=268
http://www.securityfocus.com/archive/1/475678/100/0/threaded
http://www.securityfocus.com/bid/25323
https://exchange.xforce.ibmcloud.com/vulnerabilities/35840
https://exchange.xforce.ibmcloud.com/vulnerabilities/35841