{"id": "CVE-2006-6891", "bulletinFamily": "NVD", "title": "CVE-2006-6891", "description": "Vz (Adp) Forum 2.0.3 stores sensitive information under the web root with insufficient access control, which allows remote attackers to obtain the administrative account name and password hash via a direct request for users/admin.txt.", "published": "2006-12-31T00:00:00", "modified": "2017-10-18T21:29:54", "cvss": {"score": 5.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:NONE/A:NONE/"}, "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2006-6891", "reporter": "NVD", "references": ["https://www.exploit-db.com/exploits/3053", "https://exchange.xforce.ibmcloud.com/vulnerabilities/31220"], "cvelist": ["CVE-2006-6891"], "type": "cve", "lastseen": "2017-10-19T11:12:39", "history": [{"bulletin": {"assessment": {"href": "", "name": "", "system": ""}, "bulletinFamily": "NVD", "cpe": ["cpe:/a:vz_forum:vz_forum:2.0.3"], "cvelist": ["CVE-2006-6891"], "cvss": {"score": 5.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:NONE/A:NONE/"}, "description": "Vz (Adp) Forum 2.0.3 stores sensitive information under the web root with insufficient access control, which allows remote attackers to obtain the administrative account name and password hash via a direct request for users/admin.txt.", "edition": 1, "enchantments": {}, "hash": "009d33e55aaf136b97f0e3410fbea3fecec1cdc4a8409b8ce3695d15039ed39b", "hashmap": [{"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "scanner"}, {"hash": "6b4373ba83feac15fc0c6fc449c748c4", "key": "cpe"}, {"hash": "601892ece72be3be2f57266ca2354792", "key": "reporter"}, {"hash": "995868a9ddff85c02312618012e67e47", "key": "published"}, {"hash": "6d3f4796275bb54c21a33b82f399cc6d", "key": "assessment"}, {"hash": "3d2e4843511482c1eec3d2c978a64b04", "key": "references"}, {"hash": "67b0220b6587715d2c0effc6b563444f", "key": "modified"}, {"hash": "86b7795364aabbed1586e97e3f247208", "key": "title"}, {"hash": "1716b5fcbb7121af74efdc153d0166c5", "key": "type"}, {"hash": "a792e2393dff1e200b885c5245988f6f", "key": "cvss"}, {"hash": "dc8d3d693ff8717f5a4096eab3b24b8e", "key": "cvelist"}, {"hash": "d5e56b72781dca34e7eb9315d11bcf48", "key": "href"}, {"hash": "601892ece72be3be2f57266ca2354792", "key": "bulletinFamily"}, {"hash": "a0de0a8cd6b964b57c0817c5153128a1", "key": "description"}], "history": [], "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2006-6891", "id": "CVE-2006-6891", "lastseen": "2016-09-03T08:06:45", "modified": "2011-03-07T21:47:13", "objectVersion": "1.2", "published": "2006-12-31T00:00:00", "references": ["http://milw0rm.com/exploits/3053", "http://xforce.iss.net/xforce/xfdb/31220"], "reporter": "NVD", "scanner": [], "title": "CVE-2006-6891", "type": "cve", "viewCount": 0}, "differentElements": ["references", "modified"], "edition": 1, "lastseen": "2016-09-03T08:06:45"}, {"bulletin": {"assessment": {"href": "", "name": "", "system": ""}, "bulletinFamily": "NVD", "cpe": ["cpe:/a:vz_forum:vz_forum:2.0.3"], "cvelist": ["CVE-2006-6891"], "cvss": {"score": 5.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:NONE/A:NONE/"}, "description": "Vz (Adp) Forum 2.0.3 stores sensitive information under the web root with insufficient access control, which allows remote attackers to obtain the administrative account name and password hash via a direct request for users/admin.txt.", "edition": 2, "enchantments": {}, "hash": "ca1260357d2ee86f697457081c1b51d827aae10b3e3bd8845c369c5a59f40238", "hashmap": [{"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "scanner"}, {"hash": "6b4373ba83feac15fc0c6fc449c748c4", "key": "cpe"}, {"hash": "601892ece72be3be2f57266ca2354792", "key": "reporter"}, {"hash": "564afb284cd6da97a6ac39dc624588f0", "key": "references"}, {"hash": "995868a9ddff85c02312618012e67e47", "key": "published"}, {"hash": "6d3f4796275bb54c21a33b82f399cc6d", "key": "assessment"}, {"hash": "86b7795364aabbed1586e97e3f247208", "key": "title"}, {"hash": "1716b5fcbb7121af74efdc153d0166c5", "key": "type"}, {"hash": "a792e2393dff1e200b885c5245988f6f", "key": "cvss"}, {"hash": "dc8d3d693ff8717f5a4096eab3b24b8e", "key": "cvelist"}, {"hash": "d5e56b72781dca34e7eb9315d11bcf48", "key": "href"}, {"hash": "601892ece72be3be2f57266ca2354792", "key": "bulletinFamily"}, {"hash": "d36f003071ad21753c0f475a316a2515", "key": "modified"}, {"hash": "a0de0a8cd6b964b57c0817c5153128a1", "key": "description"}], "history": [], "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2006-6891", "id": "CVE-2006-6891", "lastseen": "2017-07-29T11:21:45", "modified": "2017-07-28T21:29:43", "objectVersion": "1.3", "published": "2006-12-31T00:00:00", "references": ["http://milw0rm.com/exploits/3053", "https://exchange.xforce.ibmcloud.com/vulnerabilities/31220"], "reporter": "NVD", "scanner": [], "title": "CVE-2006-6891", "type": "cve", "viewCount": 0}, "differentElements": ["references", "modified"], "edition": 2, "lastseen": "2017-07-29T11:21:45"}], "edition": 3, "hashmap": [{"key": "assessment", "hash": "6d3f4796275bb54c21a33b82f399cc6d"}, {"key": "bulletinFamily", "hash": "601892ece72be3be2f57266ca2354792"}, {"key": "cpe", "hash": "6b4373ba83feac15fc0c6fc449c748c4"}, {"key": "cvelist", "hash": "dc8d3d693ff8717f5a4096eab3b24b8e"}, {"key": "cvss", "hash": "a792e2393dff1e200b885c5245988f6f"}, {"key": "description", "hash": "a0de0a8cd6b964b57c0817c5153128a1"}, {"key": "href", "hash": "d5e56b72781dca34e7eb9315d11bcf48"}, {"key": "modified", "hash": "fa28b3bf45c242c0e560cee259bbf146"}, {"key": "published", "hash": "995868a9ddff85c02312618012e67e47"}, {"key": "references", "hash": "cc86292e5c69900c809611981ae2212f"}, {"key": "reporter", "hash": "601892ece72be3be2f57266ca2354792"}, {"key": "scanner", "hash": "d41d8cd98f00b204e9800998ecf8427e"}, {"key": "title", "hash": "86b7795364aabbed1586e97e3f247208"}, {"key": "type", "hash": "1716b5fcbb7121af74efdc153d0166c5"}], "hash": "37da9cadaa014168b1fa14668e53e9857d018173359f3add8c6a055660b955c7", "viewCount": 0, "enchantments": {"score": {"value": 5.0, "vector": "NONE", "modified": "2017-10-19T11:12:39"}, "dependencies": {"references": [{"type": "osvdb", "idList": ["OSVDB:37553"]}, {"type": "exploitdb", "idList": ["EDB-ID:3053"]}], "modified": "2017-10-19T11:12:39"}, "vulnersScore": 5.0}, "objectVersion": "1.3", "cpe": ["cpe:/a:vz_forum:vz_forum:2.0.3"], "assessment": {"href": "", "name": "", "system": ""}, "scanner": []}

{"osvdb": [{"lastseen": "2017-04-28T13:20:33", "bulletinFamily": "software", "description": "## Manual Testing Notes\nhttp:/[target]/[path]/users/admin.txt\n## References:\nISS X-Force ID: 31220\nGeneric Exploit URL: http://milw0rm.com/exploits/3053\n[CVE-2006-6891](https://vulners.com/cve/CVE-2006-6891)\n", "modified": "2006-12-31T19:01:25", "published": "2006-12-31T19:01:25", "href": "https://vulners.com/osvdb/OSVDB:37553", "id": "OSVDB:37553", "title": "Vz (Adp) Forum users/admin.txt Direct Request Admin Credential Disclosure", "type": "osvdb", "cvss": {"score": 5.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:NONE/A:NONE/"}}], "exploitdb": [{"lastseen": "2016-01-31T17:38:05", "bulletinFamily": "exploit", "description": "Vz (Adp) Forum 2.0.3 Remote Password Disclosure Vulnerablity. CVE-2006-6891. Webapps exploit for php platform", "modified": "2006-12-31T00:00:00", "published": "2006-12-31T00:00:00", "id": "EDB-ID:3053", "href": "https://www.exploit-db.com/exploits/3053/", "type": "exploitdb", "title": "Vz Adp Forum 2.0.3 - Remote Password Disclosure Vulnerablity", "sourceData": "##########################################################################################################\n#Sv(ADP) Forum 2.0.3 Remote Password Disclosure Vulnerablity \n##########################################################################################################\n#S.name:ADP Forum \n#Affected version:2.0.3 \n#Download&Demo:http://www.linux.it/~fedro/index.php?pag=scripts&lang=en \n#Risk:Very Highly Critical \n##########################################################################################################\n#Author:Dr Max Virus \n#Location:Egypt \n##########################################################################################################\n#POC: \n#http:/[target]/[path]/users/admin.txt \n#As We see Admin name and hash !!!!!!!!!!!!!!!!!!!!!!!!!!\n##########################################################################################################\n#You can crack the password with any md5 encrypt \n \n#Or u can register and inject the info in any cookie editor can be in \nFireFox or Opera \n##########################################################################################################\n#Dork:ADP Forum 2.0.3 is powered by VzScripts \n##########################################################################################################\n#Thx:str0ke-koray-Timq-r0ut3r-mTk-nuffsaid-MrSwan-All Friends \n#Special Gr33ts:AsianEagle-Kacper-The master-Hotturk \n##########################################################################################################\n\n# milw0rm.com [2006-12-31]\n", "cvss": {"score": 5.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:NONE/A:NONE/"}, "sourceHref": "https://www.exploit-db.com/download/3053/"}]}