Gossamer Threads DBMan 信息泄露漏洞

Gossamer Threads DBMan 信息泄露漏洞

漏洞ID 1105817 漏洞类型 设计错误
发布时间 2000-05-05 更新时间 2005-07-27
图片[1]-Gossamer Threads DBMan 信息泄露漏洞-安全小百科CVE编号 CVE-2000-0381
图片[2]-Gossamer Threads DBMan 信息泄露漏洞-安全小百科CNNVD-ID CNNVD-200005-028
漏洞平台 Multiple CVSS评分 6.4
|漏洞来源
https://www.exploit-db.com/exploits/19903
http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-200005-028
|漏洞详情
GossamerThreadsDBMandb.cgi的公共网关接口脚本存在漏洞,远程攻击者可以通过在db参数中引用不存在的数据库查看环境变量和设置信息。
|漏洞EXP
source: http://www.securityfocus.com/bid/1178/info

Requesting an invalid database file from a web server implementing Gossamer Threads DBMan scripts will return a CGI error message containing environmental variables to a remote user without any authorization. The parameters displayed include the local document root path, server administrator account name, web server software, platform, etc.

http://target/scripts/dbman/db.cgi?db=invalid-db
|参考资料

来源:www.perfectotech.com
链接:http://www.perfectotech.com/blackwatchlabs/vul5_05.html
来源:BID
名称:1178
链接:http://www.securityfocus.com/bid/1178
来源:BUGTRAQ
名称:20000505BlackWatchLabsVulnerabilityAlert
链接:http://archives.neohapsis.com/archives/bugtraq/2000-05/0067.html

相关推荐: Microsoft Windows 2000 Help Facility .CNT File :Link Buffer Overflow Vulnerability

Microsoft Windows 2000 Help Facility .CNT File :Link Buffer Overflow Vulnerability 漏洞ID 1100736 漏洞类型 Boundary Condition Error 发布时间…

© 版权声明
THE END
喜欢就支持一下吧
点赞0
分享