CVE-2009-0964

Опубликовано: 19 мар. 2009

Источник: nvd

CVSS3: 7.5

CVSS2: 5

EPSS Низкий

Описание

UserView_list.php in PHPRunner 4.2, and possibly earlier, stores passwords in cleartext in the database, which allows attackers to gain privileges. NOTE: this can be leveraged with a separate SQL injection vulnerability to obtain passwords remotely without authentication.

Ссылки

http://osvdb.org/52804
Broken Link
http://www.bugreport.ir/index_63.htm
Broken Link
Exploit
http://www.securityfocus.com/archive/1/501894/100/0/threaded
Broken Link
Third Party Advisory
VDB Entry
http://www.vupen.com/english/advisories/2009/0750
Broken Link
https://exchange.xforce.ibmcloud.com/vulnerabilities/49279
Third Party Advisory
VDB Entry
https://www.exploit-db.com/exploits/8226
Exploit
Third Party Advisory
VDB Entry
http://osvdb.org/52804
Broken Link
http://www.bugreport.ir/index_63.htm
Broken Link
Exploit
http://www.securityfocus.com/archive/1/501894/100/0/threaded
Broken Link
Third Party Advisory
VDB Entry
http://www.vupen.com/english/advisories/2009/0750
Broken Link
https://exchange.xforce.ibmcloud.com/vulnerabilities/49279
Third Party Advisory
VDB Entry
https://www.exploit-db.com/exploits/8226
Exploit
Third Party Advisory
VDB Entry

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:xlinesoft:phprunner:*:*:*:*:*:*:*:*

Версия до 4.2 (включая)

EPSS

Процентиль: 75%

0.00865

Низкий

7.5 High

CVSS3

5 Medium

CVSS2

Дефекты

CWE-312

Связанные уязвимости

GHSA-j933-cghj-hrpx