Acidcat CMS install.asp information disclosure
| acidcat-install-info-disclosure (55331) |  Low Risk |
Description:
Acidcat CMS could allow a remote attacker to obtain sensitive information, caused by the existence of the install.asp script within the Web root. An attacker could exploit this vulnerability via a direct request to obtain configuration information.
Consequences:
Obtain Information
Remedy:
No remedy available as of May 1, 2013.
References:
- Acidcat CMS Web site: Acidcat ASP CMS.
- Offensive Security Exploit Database [01-03-2010]: Acidcat CMS v3.5 Multiple Vulnerabilities .
- CVE-2010-0976: Acidcat CMS 3.5.x does not prevent access to install.asp after installation finishes, which might allow remote attackers to restart the installation process and have unspecified other impact via requests to install.asp and other install_*.asp scripts. NOTE: the final installation screen states Important: you must now delete all files beginning with install from the root directory.
- OSVDB ID: 63077: Acidcat CMS install.asp Permission Weakness Installation Process Manipulation
Platforms Affected:
- Acidcat ASP CMS Acidcat CMS 3.5
- Acidcat ASP CMS Acidcat CMS 3.5.3
Reported:
Jan 03, 2010
The information within this database may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall the author/distributor (IBM Internet Security Systems X-Force) be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.
For corrections or additions please email ignore thisxforceignore this@ignore thisus.ignore thisibm.comignore this