DigiOz DigiOz Guestbook up to 1.7.0 Error Message list.php page information disclosure

Summaryinfo

A vulnerability marked as problematic has been reported in DigiOz DigiOz Guestbook up to 1.7.0. This impacts an unknown function of the file list.php of the component Error Message Handler. This manipulation of the argument page causes information disclosure. This vulnerability appears as CVE-2006-5651. In addition, an exploit is available. It is suggested to upgrade the affected component.

Detailsinfo

A vulnerability was found in DigiOz DigiOz Guestbook up to 1.7.0. It has been declared as problematic. Affected by this vulnerability is an unknown code of the file list.php of the component Error Message Handler. The manipulation of the argument page with an unknown input leads to a information disclosure vulnerability. The CWE definition for the vulnerability is CWE-200. The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. As an impact it is known to affect confidentiality. The summary by CVE is:

list.php in DigiOz Guestbook before 1.7.1 allows remote attackers to obtain sensitive information via a non-numeric page parameter, which displays the installation path in the resulting error message.

The weakness was presented 11/06/2006 by Jesper Jurcenoks as not defined posting (Bugtraq). It is possible to read the advisory at securityfocus.com. This vulnerability is known as CVE-2006-5651 since 11/02/2006. The exploitation appears to be easy. The attack can be launched remotely. The exploitation doesn't need any form of authentication. Technical details and also a exploit are known. The attack technique deployed by this issue is T1592 according to MITRE ATT&CK.

After immediately, there has been an exploit disclosed. It is declared as proof-of-concept. By approaching the search of inurl:list.php it is possible to find vulnerable targets with Google Hacking.

Upgrading to version 1.7.1 eliminates this vulnerability.

The vulnerability is also documented in the databases at X-Force (30067) and OSVDB (29985†). Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Vendor

• DigiOz

Name

• DigiOz Guestbook

Version

• 1.0
• 1.1
• 1.2
• 1.3
• 1.4
• 1.5
• 1.6
• 1.7.0

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion