CVE-2007-6603
Hot or Not Clone has insufficient access control for producing and reading database backups, which allows remote attackers to obtain the administrator username and password via a direct request to control/backup/backup.php, which generates a…
Does this matter?
Lower severity and a low EPSS score (2.86%). Track it; it rarely justifies an emergency change on its own.
Description
Hot or Not Clone has insufficient access control for producing and reading database backups, which allows remote attackers to obtain the administrator username and password via a direct request to control/backup/backup.php, which generates a backup/dump/backup.sql file that can be downloaded via a direct request to control/downloadfile.php.
- CVSS 2.0
- 5.0 MEDIUMAV:N/AC:L/Au:N/C:P/I:N/A:N
- EPSS
- 2.86% probability · 86th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-264
- Affected
- hotscripts/hot or not clone
- Source
- cve@mitre.org
References
- http://osvdb.org/40572
- http://secunia.com/advisories/28261
- https://exchange.xforce.ibmcloud.com/vulnerabilities/39344
- https://www.exploit-db.com/exploits/4804
- http://osvdb.org/40572
- http://secunia.com/advisories/28261
- https://exchange.xforce.ibmcloud.com/vulnerabilities/39344
- https://www.exploit-db.com/exploits/4804
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.