0day.today - Biggest Exploit Database in the World.
- We use one main domain: http://0day.today
- Most of the materials is completely FREE
- If you want to purchase the exploit / get V.I.P. access or pay for any other service,
you need to buy or earn
GOLD
Administration of this site uses the official contacts. Beware of impostors!
We DO NOT use Telegram or any messengers / social networks!Please, beware of scammers!
- Read the [ agreement ]
- Read the [ Submit ] rules
- Visit the [ faq ] page
- [ Register ] profile
- Get [ GOLD ]
- If you want to [ sell ]
- If you want to [ buy ]
- If you lost [ Account ]
- Any questions [ admin@0day.today ]
- Authorisation page
- Registration page
- Restore account page
- FAQ page
- Contacts page
- Publishing rules
- Agreement page
Mail:
Facebook:
Twitter:
Telegram:
We DO NOT use Telegram or any messengers / social networks!
Contact us
You can contact us by:
Mail:
Facebook:
Twitter:
Telegram:
We DO NOT use Telegram or any messengers / social networks!
Information disclosure in FreePBX 2.5.x
[======================================= Information disclosure in FreePBX 2.5.x ======================================= Advisory Name: Information disclosure in FreePBX 2.5.x Internal Cybsec Advisory Id: 2010-0101 Vulnerability Class: Information disclosure Release Date: 15/01/2010 Affected Applications: Confirmed in FreePBX 2.5.x Other versions may also be affected Affected Platforms: Any running FreePBX2.5.x Local / Remote: Remote Severity: Medium – CVSS: 4 (AV:N/AC:L/Au:S/C:P/I:N/A:N) Researcher: Ivan Huertas Vendor Status: To be confirmed Reference to Vulnerability Disclosure Policy: http://www.cybsec.com/vulnerability_policy.pdf Vulnerability Description: A user with access to the “administrators†section could see other’s administrators passwords by viewing the html’s source code. Proof of Concept: In http://xx.xx.xx.xx/admin/config.php?display=ampusers&userdisplay=admin <a href=# class="info">Password<span>Create a password for this new user</span></a>: </td><td> <input type="password" size="20" name="password" value="admin" tabindex="2"/> </td> Impact: A user with access to the “administrator†sections may access to other’s administrators passwords. Solution: Update to v2.6 Vendor Response: 2009-30-12 – Vulnerability was identified 2010-01-07 – Vendor contacted 2010-01-15 – Vulnerability published Patches were available before the vulnerability was discovered. # 0day.today [2024-11-15] #