Lucene search
K

Gossamer Threads DBMan 2.0.4 - DBMan Information Leakage

🗓️ 05 May 2000 00:00:00Reported by Black Watch LabsType 
exploitdb
 exploitdb
🔗 www.exploit-db.com👁 25 Views

Invalid database request exposes sensitive system variables in Gossamer Threads DBMan 2.0.4 scripts.

Code
source: https://www.securityfocus.com/bid/1178/info

Requesting an invalid database file from a web server implementing Gossamer Threads DBMan scripts will return a CGI error message containing environmental variables to a remote user without any authorization. The parameters displayed include the local document root path, server administrator account name, web server software, platform, etc.

http://target/scripts/dbman/db.cgi?db=invalid-db

Data

Build on a solid foundation with Vulners data

We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data

Api

Power your application with Vulners API

The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access

App

Assess and manage vulnerabilities with Vulners tools

Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation