Vulnerabilities > CVE-2020-12743 - Files or Directories Accessible to External Parties vulnerability in Gazie Project Gazie

CVSS 7.5 - HIGH

Attack vector

NETWORK

Attack complexity

LOW

Privileges required

NONE

Confidentiality impact

PARTIAL

Integrity impact

PARTIAL

Availability impact

PARTIAL

network

low complexity

gazie-project

CWE-552

NVD

Published: 2020-05-11

Updated: 2020-05-15

Summary

An issue was discovered in Gazie 7.32. A successful installation does not remove or block (or in any other way prevent use of) its own file /setup/install/setup.php, meaning that anyone can request it without authentication. This file allows arbitrary PHP file inclusion via a hidden_req POST parameter.

Vulnerable Configurations

Part	Description	Count
Application	Gazie_Project Gazie Project Gazie 7.9 Gazie Project Gazie 7.10 Gazie Project Gazie 7.11 Gazie Project Gazie 7.12 Gazie Project Gazie 7.13 Gazie Project Gazie 7.14 Gazie Project Gazie 7.15 Gazie Project Gazie 7.16 Gazie Project Gazie 7.17 Gazie Project Gazie 7.18 Gazie Project Gazie 7.19 Gazie Project Gazie 7.20 Gazie Project Gazie 7.21 Gazie Project Gazie 7.22 Gazie Project Gazie 7.23 Gazie Project Gazie 7.24 Gazie Project Gazie 7.25 Gazie Project Gazie 7.26 Gazie Project Gazie 7.27 Gazie Project Gazie 7.28 Gazie Project Gazie 7.29 Gazie Project Gazie 7.30 Gazie Project Gazie 7.31 Gazie Project Gazie 7.32	24

Common Weakness Enumeration (CWE)

CWE-552 - Files or Directories Accessible to External Parties

References

https://sourceforge.net/p/gazie/code/3823/