Login Request a demo
Unscored severity · published Dec 31, 2002
CVE-2002-2289
soinfo.php in BadBlue 1.7.1 calls the phpinfo function, which allows remote attackers to gain sensitive information including ODBC passwords
–
CVSS
1.4%
EPSS
No
On KEV
Description
soinfo.php in BadBlue 1.7.1 calls the phpinfo function, which allows remote attackers to gain sensitive information including ODBC passwords.
Exploitation
Is it being used?
Exploit prediction (EPSS)1.4% · higher than 72% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
BA
Badblue · Working Resources Inc.
1.7.1 · source: NVD
Affected product
BA
Badblue
Working Resources Inc.
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2002-2289
CVE.org
https://www.cve.org/CVERecord?id=CVE-2002-2289
Exploit
http://online.securityfocus.com/archive/1/300992
Exploit
http://securityreason.com/securityalert/3243
Exploit
http://www.derkeiler.com/Mailing-Lists/Full-Disclosure/2002-11/0329.html
www.securityfocus.com
http://www.securityfocus.com/bid/6243
exchange.xforce.ibmcloud.com
https://exchange.xforce.ibmcloud.com/vulnerabilities/10690
More from Badblue
–
CVE-2005-0595
Buffer overflow in ext.dll in BadBlue 2.55 allows remote attackers to execute arbitrary code via a long mfcisapicommand parameter
–
CVE-2004-2374
BadBlue 2.4 allows remote attackers to obtain the location of the server installation path via a request for phptest.php, which includes the pathname in the source of the…
–
CVE-2004-1727
BadBlue 2.5 allows remote attackers to cause a denial of service (refuse HTTP connections) via a large number of connections from the same IP address
–
CVE-2003-0332
The ISAPI extension in BadBlue 1.7 through 2.2, and possibly earlier versions, modifies the first two letters of a filename extension after performing a security check, which…
–
CVE-2002-1541
BadBlue 1.7 allows remote attackers to bypass password protections for directories and files via an HTTP request containing an extra / (slash)