high7.5Public exploit code

CVE-2009-4465

DeluxeBB 1.3 stores sensitive information under the web root with insufficient access control, which allows remote attackers to obtain user and configuration i…

Public exploit code

Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.

DeluxeBB 1.3 - Multiple Vulnerabilities2009-12-22 · webapps · php · Verified

Impact

DeluxeBB 1.3 stores sensitive information under the web root with insufficient access control, which allows remote attackers to obtain user and configuration information, log data, and gain administrative access via a direct request to scripts in (1) templates/ including (2) templates/deluxe/admincp/, (3) templates/corporate/admincp/, and (4) templates/blue/admincp/; (5) images/; (6) logs/ including (7) logs/cp.php; (8) wysiwyg/; (9) docs/; (10) classes/; (11) lang/; and (12) settings/.

Affected products

Vendor	Product	Affected versions
Deluxebb	Deluxebb	Version 1.3

Weakness classification

CWE-264

Public exploit code

Impact

Affected products

Weakness classification

References