CVE-2007-5987 details.php in BtiTracker before 1.4.5, when torrent viewing is disabled for guests, allows remote attackers to bypass protection mechanisms via a direct request, as demonstrated by (1) reading the de...
MediumCVSS 6.8
EPSS 1.3%
- Published
- Updated
- Exploit status
- No public exploit known
Description
details.php in BtiTracker before 1.4.5, when torrent viewing is disabled for guests, allows remote attackers to bypass protection mechanisms via a direct request, as demonstrated by (1) reading the details of an arbitrary torrent and (2) modifying a torrent owned by a guest.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| bti-tracker | <= 1.3.2 | No fix listed |
| bti-tracker | <= 1.4.1 | No fix listed |
| bti-tracker | <= 1.4.2 | No fix listed |
| bti-tracker | <= 1.4.3 | No fix listed |
| bti-tracker | <= 1.4.4 | No fix listed |
References
- 42217 vdb-entry
- 27550 third-party-advisory vendor-advisory
- sourceforge.net patch
- sourceforge.net
- 26551 vdb-entry
- btitracker-details-security-bypass(38416) vdb-entry