Acidcat CMS install.asp information disclosure

acidcat-install-info-disclosure (55331) The risk level is classified as LowLow Risk

Description:

Acidcat CMS could allow a remote attacker to obtain sensitive information, caused by the existence of the install.asp script within the Web root. An attacker could exploit this vulnerability via a direct request to obtain configuration information.

*CVSS:

Base Score: 5
  Access Vector: Network
  Access Complexity: Low
  Authentication: None
  Confidentiality Impact: Partial
  Integrity Impact: None
  Availability Impact: None
 
Temporal Score: 4.8
  Exploitability: High
  Remediation Level: Unavailable
  Report Confidence: Uncorroborated

Consequences:

Obtain Information

Remedy:

No remedy available as of September 1, 2014.

References:

  • Acidcat CMS Web site: Acidcat ASP CMS.
  • Offensive Security Exploit Database [01-03-2010]: Acidcat CMS v3.5 Multiple Vulnerabilities .
  • CVE-2010-0976: Acidcat CMS 3.5.x does not prevent access to install.asp after installation finishes, which might allow remote attackers to restart the installation process and have unspecified other impact via requests to install.asp and other install_*.asp scripts. NOTE: the final installation screen states Important: you must now delete all files beginning with install from the root directory.
  • OSVDB ID: 63077: Acidcat CMS install.asp Permission Weakness Installation Process Manipulation

Platforms Affected:

  • Acidcat ASP CMS Acidcat CMS 3.5
  • Acidcat ASP CMS Acidcat CMS 3.5.3

Reported:

Jan 03, 2010

The information within this database may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall the author/distributor (IBM Internet Security Systems X-Force) be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.

For corrections or additions please email ignore thisxforceignore this@ignore thisus.ignore thisibm.comignore this

Return to the main page