Vulnerabilities > CVE-2020-12743 - Files or Directories Accessible to External Parties vulnerability in Gazie Project Gazie

CVSS 9.8 - CRITICAL

Attack vector

NETWORK

Attack complexity

LOW

Privileges required

NONE

Confidentiality impact

HIGH

Integrity impact

HIGH

Availability impact

HIGH

network

low complexity

gazie-project

CWE-552

critical

NVD

Published: 2020-05-11

Updated: 2020-05-15

Summary

An issue was discovered in Gazie 7.32. A successful installation does not remove or block (or in any other way prevent use of) its own file /setup/install/setup.php, meaning that anyone can request it without authentication. This file allows arbitrary PHP file inclusion via a hidden_req POST parameter.

Vulnerable Configurations

Part	Description	Count
Application	Gazie_Project Gazie Project Gazie 7.9 Gazie Project Gazie 7.10 Gazie Project Gazie 7.11 Gazie Project Gazie 7.12 Gazie Project Gazie 7.13 Gazie Project Gazie 7.14 Gazie Project Gazie 7.15 Gazie Project Gazie 7.16 Gazie Project Gazie 7.17 Gazie Project Gazie 7.18 Gazie Project Gazie 7.19 Gazie Project Gazie 7.20 Gazie Project Gazie 7.21 Gazie Project Gazie 7.22 Gazie Project Gazie 7.23 Gazie Project Gazie 7.24 Gazie Project Gazie 7.25 Gazie Project Gazie 7.26 Gazie Project Gazie 7.27 Gazie Project Gazie 7.28 Gazie Project Gazie 7.29 Gazie Project Gazie 7.30 Gazie Project Gazie 7.31 Gazie Project Gazie 7.32	24

Common Weakness Enumeration (CWE)

CWE-552 - Files or Directories Accessible to External Parties

References

https://sourceforge.net/p/gazie/code/3823/