medium5.0Public exploit code
CVE-2007-5113
report.cgi in Google Urchin allows remote attackers to bypass authentication and obtain sensitive information (web server logs) via certain modified query para…
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- Google Urchin 5.7.3 - 'Report.cgi' Authentication Bypass2007-10-11 · webapps · cgi · Verified
Impact
report.cgi in Google Urchin allows remote attackers to bypass authentication and obtain sensitive information (web server logs) via certain modified query parameters, as demonstrated using the profile, rid, prefs, n, vid, bd, ed, dt, and gtype parameters, a different vulnerability than CVE-2007-5112.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Roi Revolution | Urchin | through 5.7.03 |
Weakness classification
References
- NVD record
- CVE.org record
- http://ha.ckers.org/blog/20070823/xss-and-possible-information-disclosure-in-urchin/
- http://securityvulns.ru/Sdocument90.html
- http://websecurity.com.ua/1283/
- http://www.securityfocus.com/archive/1/482006/100/0/threaded
- http://www.securityfocus.com/bid/26037
- http://ha.ckers.org/blog/20070823/xss-and-possible-information-disclosure-in-urchin/
- http://securityvulns.ru/Sdocument90.html
- http://websecurity.com.ua/1283/
- http://www.securityfocus.com/archive/1/482006/100/0/threaded
- http://www.securityfocus.com/bid/26037