← back
CVE-2009-0700

CVE-2009-0700

EPSS 2.5%
Plunet BusinessManager 4.1 and earlier allows remote authenticated users to bypass access restrictions and (1) read sensitive Customer or Order data via a modified Pfad parameter to pagesUTF8/Sys_DirAnzeige.jsp, or (2) list sensitive Jobs via a direct request to pagesUTF8/auftrag_job.jsp.
Affected products
n/a · n/a
public PoCs found — 2
exploitdbwww.exploit-db.com/exploits/32710unverifiedexploitdbwww.exploit-db.com/exploits/32709unverified
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →
References
http://archives.neohapsis.com/archives/bugtraq/2009-01/0032.htmlhttp://archives.neohapsis.com/archives/bugtraq/2009-01/0054.htmlhttps://exchange.xforce.ibmcloud.com/vulnerabilities/47794http://www.securenetwork.it/ricerca/advisory/download/SN-2008-04.txthttp://www.securityfocus.com/bid/33153