CVE-2006-2347
E-Business Designer (eBD) 3.1.4 and earlier allows remote attackers to obtain the full path of the web server via "'" characters, and possibly other invalid values, in (1) the id parameter to form_grupo.html, or requests to the (2) archivos/ and (3)…
Does this matter?
Lower severity and a low EPSS score (1.35%). Track it; it rarely justifies an emergency change on its own.
Description
E-Business Designer (eBD) 3.1.4 and earlier allows remote attackers to obtain the full path of the web server via "'" characters, and possibly other invalid values, in (1) the id parameter to form_grupo.html, or requests to the (2) archivos/ and (3) files/ directories. NOTE: this issue might be resultant from SQL injection.
- CVSS 2.0
- 5.0 MEDIUMAV:N/AC:L/Au:N/C:P/I:N/A:N
- EPSS
- 1.35% probability · 70th percentile
- CISA KEV
- Not listed
- Affected
- oasyssoft/e-business designer
- Source
- cve@mitre.org
References
- http://lists.grok.org.uk/pipermail/full-disclosure/2006-May/045980.htmlVendor Advisory
- http://secunia.com/advisories/20071Vendor Advisory
- http://securityreason.com/securityalert/891
- http://www.securityfocus.com/archive/1/433807/100/0/threaded
- http://www.securityfocus.com/bid/17933
- http://www.vupen.com/english/advisories/2006/1784
- https://exchange.xforce.ibmcloud.com/vulnerabilities/26476
- http://lists.grok.org.uk/pipermail/full-disclosure/2006-May/045980.htmlVendor Advisory
- http://secunia.com/advisories/20071Vendor Advisory
- http://securityreason.com/securityalert/891
- http://www.securityfocus.com/archive/1/433807/100/0/threaded
- http://www.securityfocus.com/bid/17933
- http://www.vupen.com/english/advisories/2006/1784
- https://exchange.xforce.ibmcloud.com/vulnerabilities/26476
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.