CyberSec.Space Logo
CVEブラウザに戻る

CVE-2007-0385

HIGH
7.8
CVSS Severity Score
EPSS Score0.0420%
EPSS Percentile32.71th
Published2007年1月19日
Last Modified2026年4月23日

Vulnerability Description

The faq section in PostNuke 0.764 allows remote attackers to obtain sensitive information (the full path) via "unvalidated output" in FAQ/index.php, possibly involving an undefined id_cat variable.

Affected Platforms (CPE)

📦
Postnuke Software Foundation

Postnuke

= 0.764

References & Advisories

🔗 http://archives.neohapsis.com/archives/fulldisclosure/2007-01/0355.html
🔗 http://noc.postnuke.com/plugins/scmsvn/viewcvs.php/trunk/Historic/PostNuke7x/html/modules/?root=postnuke
🔗 http://noc.postnuke.com/plugins/scmsvn/viewcvs.php/trunk/Historic/PostNuke7x/html/modules/FAQ/index.php?root=postnuke&r1=20350&r2=20911
🔗 http://osvdb.org/35472
🔗 http://www.hackers.ir/advisories/festival.txt
🔗 http://archives.neohapsis.com/archives/fulldisclosure/2007-01/0355.html
🔗 http://noc.postnuke.com/plugins/scmsvn/viewcvs.php/trunk/Historic/PostNuke7x/html/modules/?root=postnuke
🔗 http://noc.postnuke.com/plugins/scmsvn/viewcvs.php/trunk/Historic/PostNuke7x/html/modules/FAQ/index.php?root=postnuke&r1=20350&r2=20911

関連する脆弱性情報

CVE-2007-038610.0

Unspecified vulnerability in the rating section in PostNuke 0.764 has unknown impact and attack vectors, related to "an interestin...

CVE-2006-62677.8

PostNuke 0.7.5.0, and certain minor versions, allows remote attackers to obtain sensitive information via a non-numeric value of t...

CVE-2002-10707.5

Cross-site scripting vulnerability in PHPWiki Postnuke wiki module allows remote attackers to execute script as other PHPWiki user...

CVE-2001-14607.5

SQL injection vulnerability in article.php in PostNuke 0.62 through 0.64 allows remote attackers to bypass authentication via the ...