Vulnerabilities > CVE-2002-0282 - Unspecified vulnerability in Codeworx Technologies Dcp-Portal
Attack vector
UNKNOWN Attack complexity
UNKNOWN Privileges required
UNKNOWN Confidentiality impact
UNKNOWN Integrity impact
UNKNOWN Availability impact
UNKNOWN codeworx-technologies
nessus
Summary
DCP-Portal 3.7 through 4.5 allows remote attackers to obtain the physical path of the server via (1) a direct request to add_user.php, or via an invalid new_language parameter in (2) contents.php, (3) categories.php, or (4) files.php, which leaks the path in an error message.
Vulnerable Configurations
| Part | Description | Count |
|---|---|---|
| Application | 5 |
Nessus
| NASL family | CGI abuses |
| NASL id | DCP_PORTAL_PATH_DISCLOSURE.NASL |
| description | DCP-Portal discloses its physical path when an empty request to add_user.php is made In addition, several other scripts may disclose the path if an invalid language is supplied, although Nessus has not checked for them. |
| last seen | 2020-06-01 |
| modified | 2020-06-02 |
| plugin id | 11477 |
| published | 2003-03-26 |
| reporter | This script is Copyright (C) 2003-2018 Tenable Network Security, Inc. |
| source | https://www.tenable.com/plugins/nessus/11477 |
| title | DCP-Portal Multiple Script Path Disclosure |
References
- http://marc.info/?l=bugtraq&m=101379160830631&w=2
- http://marc.info/?l=bugtraq&m=101379160830631&w=2
- http://marc.info/?l=bugtraq&m=101494497608620&w=2
- http://marc.info/?l=bugtraq&m=101494497608620&w=2
- http://www.dcp-portal.com/files.php?action=viewcat&fcat_id=1
- http://www.dcp-portal.com/files.php?action=viewcat&fcat_id=1
- http://www.iss.net/security_center/static/8310.php
- http://www.iss.net/security_center/static/8310.php
- http://www.securityfocus.com/bid/4113
- http://www.securityfocus.com/bid/4113
- https://exchange.xforce.ibmcloud.com/vulnerabilities/8196
- https://exchange.xforce.ibmcloud.com/vulnerabilities/8196