Summaryinfo

A vulnerability described as problematic has been identified in TalkBack 2.3.6. This issue affects the function phpinfo. The manipulation results in information disclosure. This vulnerability is known as CVE-2008-4115. Furthermore, an exploit is available.

Detailsinfo

A vulnerability was found in TalkBack 2.3.6. It has been classified as problematic. Affected is the function phpinfo. The manipulation with an unknown input leads to a information disclosure vulnerability. CWE is classifying the issue as CWE-200. The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. This is going to have an impact on confidentiality. CVE summarizes:

TalkBack 2.3.6 allows remote attackers to obtain configuration information via a direct request to install/info.php, which calls the phpinfo function.

The weakness was published 09/16/2008 (Website). The advisory is available at milw0rm.com. This vulnerability is traded as CVE-2008-4115 since 09/16/2008. The exploitability is told to be easy. It is possible to launch the attack remotely. The exploitation doesn't require any form of authentication. Technical details and a public exploit are known. This vulnerability is assigned to T1592 by the MITRE ATT&CK project.

The exploit is shared for download at exploit-db.com. It is declared as proof-of-concept.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The vulnerability is also documented in the databases at X-Force (45103), Exploit-DB (6451) and Secunia (SA31879†). Similar entry is available at VDB-44269. VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Name

• TalkBack

Version

• 2.3.6

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Discussion