CVE-2005-2474
ChurchInfo allows remote attackers to execute obtain sensitive information via the PersonID parameter to (1) PersonView.php, (2) MemberRoleChange.php, (3) PropertyAssign.php, (4) WhyCameEditor.php, (5) GroupPropsEditor.php, (6) Reports/PDFLabel.php, or…
Does this matter?
Lower severity and a low EPSS score (2.26%). Track it; it rarely justifies an emergency change on its own.
Description
ChurchInfo allows remote attackers to execute obtain sensitive information via the PersonID parameter to (1) PersonView.php, (2) MemberRoleChange.php, (3) PropertyAssign.php, (4) WhyCameEditor.php, (5) GroupPropsEditor.php, (6) Reports/PDFLabel.php, or (7) UserDelete.php, an invalid Number parameter to (8) SelectList.php or (9) SelectDelete.php, GroupID parameter to (10) GroupView.php, (11) GroupMemberList.php, (12) MemberRoleChange.php, (13) GroupDelete.php, (14) /Reports/ClassAttendance.php, or (15) /Reports/GroupReport.php, (16) PropertyID parameter to PropertyEditor.php, FamilyID parameter to (17) Canvas05Editor.php, (18) CanvasEditor.php, or (19) FamilyView.php, or (20) PledgeID parameter to PledgeDetails.php, which reveal the path in an error message.
- CVSS 2.0
- 5.0 MEDIUMAV:N/AC:L/Au:N/C:P/I:N/A:N
- EPSS
- 2.26% probability · 82th percentile
- CISA KEV
- Not listed
- Affected
- churchinfo/churchinfo
- Source
- cve@mitre.org
References
- http://marc.info/?l=bugtraq&m=112291550713546&w=2
- http://secunia.com/advisories/16292
- http://securitytracker.com/id?1014617
- http://www.osvdb.org/18425
- http://www.osvdb.org/18426
- http://www.osvdb.org/18429
- http://www.osvdb.org/18430
- http://www.osvdb.org/18431
- http://www.osvdb.org/18432
- http://www.osvdb.org/18433
- http://www.osvdb.org/18434
- http://www.osvdb.org/18435
- http://www.osvdb.org/18436
- http://www.osvdb.org/18437
- http://www.osvdb.org/18438
- http://www.osvdb.org/18439
- http://www.osvdb.org/18450
- https://exchange.xforce.ibmcloud.com/vulnerabilities/21648
- http://marc.info/?l=bugtraq&m=112291550713546&w=2
- http://secunia.com/advisories/16292
- http://securitytracker.com/id?1014617
- http://www.osvdb.org/18425
- http://www.osvdb.org/18426
- http://www.osvdb.org/18429
- http://www.osvdb.org/18430
- http://www.osvdb.org/18431
- http://www.osvdb.org/18432
- http://www.osvdb.org/18433
- http://www.osvdb.org/18434
- http://www.osvdb.org/18435
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.