OSVDB ID: 4081 Title: Greymatter Remote Admin Account Compromise |
Info |
|
|
Dates |
||||
|
|
Description |
Greymatter allows a remote attacker to retrieve a file that contains the administrative login and password stored in plaintext. The issue is due to the package storing this information in a file named "gmrightclick*reg" (where * is a six digit number) and being readable via the web server. With this information, an attacker can login with administrative privileges and have full control over the Greymatter installation. |
Classification |
Location:
Remote / Network Access
Attack Type: Information Disclosure Impact: Loss of Confidentiality, Loss of Integrity Exploit: Exploit Public Disclosure: OSVDB Verified OSVDB: Web Related |
Solution |
Upgrade to version 1.3 or higher, as it has been reported to fix this vulnerability. An upgrade is required as there are no known workarounds. |
Products |
|
References |
|
Credit |
|
attrition.org - attrition.org