NVD

Id
56390  
Name
CVE-2007-4261  
Description
EZPhotoSales 1.9.3 and earlier stores sensitive information under the web root with insufficient access control, which allows remote attackers to download (1) a file containing cleartext passwords via a direct request for OnlineViewing/data/galleries.txt, or (2) a file containing username hashes and password hashes via a direct request for OnlineViewing/configuration/config.dat/. NOTE: vector 2 can be leveraged for administrative access because authentication does not require knowledge of cleartext values, but instead uses the username hash in the ConfigLogin parameter and the password hash in the ConfigPassword parameter.  
Reject
 
CVSS Version
2  
CVSS Score
7.5  
Severity
High  
CVSS Base Score
7.5  
CVSS Impact Subscore
6.4  
CVSS Exploit Subscore
10  
CVSS Vector
(AV:N/AC:L/Au:N/C:P/I:P/A:P)  
Pub Date
2017-01-07  
Published
2007-08-08  
Modified Date
2012-11-05  
Seq
2007-4261  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
287185 56390 CVE-2007-4261 2985  View
287186 56390 CVE-2007-4261 http://www.airscanner.com/security/07080601_ezphotosales.htm  View
287187 56390 CVE-2007-4261 http://www.informit.com/guides/content.asp?g=security&seqNum=267  View
287188 56390 CVE-2007-4261 http://www.informit.com/guides/content.asp?g=security&seqNum=268  View
287189 56390 CVE-2007-4261 20070806 EZPhotoSales 1.9.3 Multiple Vulnerabilities  View
287190 56390 CVE-2007-4261 25323  View
287191 56390 CVE-2007-4261 ezphotosales-galleries-info-disclosure(35840)  View
287192 56390 CVE-2007-4261 ezphotosales-config-information-disclosure(35841)  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
53795 JVNDB-2007-002487 EZPhotoSales におけるパスワードをダウンロードされる脆弱性 EZPhotoSales には、不十分なアクセスコントロールで Web ルート配下に重要な情報を格納するため、以下のファイルをダウンロードされる脆弱性が存在します。 CVE-2007-4261 27616 CVE-2007-4261 56390 7.5 http://jvndb.jvn.jp/ja/contents/2007/JVNDB-2007-002487.html 2007-08-08 2012-06-26 View