CVE-2007-4937 CS Guestbook stores sensitive information under the web root with insufficient access control, which allows remote attackers to obtain the admin name and MD5 password hash via a direct request for bas...
MediumCVSS 5.0
EPSS 2.6%
- Published
- Updated
- Exploit status
- No public exploit known
Description
CS Guestbook stores sensitive information under the web root with insufficient access control, which allows remote attackers to obtain the admin name and MD5 password hash via a direct request for base/usr/0.php.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| comscripts cs guestbook | All versions | No fix listed |
References
- 26805 third-party-advisory
- 3147 third-party-advisory
- 20070912 CS Guestbook Admin Name & Md5 Security Vuln mailing-list
- 25652 exploit vdb-entry
- csguestbook-zero-information-disclosure(36587) vdb-entry