Improper access control

2009-01-0617:30:00

PRIOn knowledge base

www.prio-n.com

6.9 Medium

AI Score

Confidence

Low

0.005 Low

EPSS

Percentile

76.8%

JSON

Chilek Content Management System (aka ChiCoMaS) 2.0.4 and earlier stores sensitive information under the web root with insufficient access control, which allows remote attackers to (1) obtain database credentials via a direct request for config.inc or (2) read database backups via a request for a backup/ URI.

CPENameOperatorVersion
chicomasle2.0.4
chicomaseq2.0.3

CPE	Name	Operator	Version
	chicomas	le	2.0.4
	chicomas	eq	2.0.3

References

secunia.com/advisories/30080

securityreason.com/securityalert/4872

www.bugreport.ir/index_59.htm

www.securityfocus.com/archive/1/499458/100/0/threaded

www.exploit-db.com/exploits/7532