CVE-2000-0074
published 2000-01-11CVE-2000-0074: PowerScripts PlusMail CGI program allows remote attackers to execute commands via a password file with improper permissions.
PriorityP337high7.5CVSS 2.0
AVNACLAuNCPIPAP
EXPLOIT
EPSS
9.78%
94.9th percentile
PowerScripts PlusMail CGI program allows remote attackers to execute commands via a password file with improper permissions.
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No detection rules found.
Exploit-DB
Technote 2000/2001 - 'board' File Disclosure
exploitdb·2000-12-23
CVE-2001-0074 Technote 2000/2001 - 'board' File Disclosure
Technote 2000/2001 - 'board' File Disclosure
---
source: https://www.securityfocus.com/bid/2155/info
Technote Inc. offers a Multicommunication Package which includes a web board type of service.
A script that ships with Technote, print.cgi, accepts a parameter called "board". This remotely-supplied variable is used as a filename when the open() function is called. In addition to allowing the attacker to specify a file to be opened remotely, the variable is not checked for "../" character sequences. As a result, a malicious remote user can specify an arbitrary file on the file system as this variable (by using ../ sequences followed by its real path), which will be opened by the script. Its contents will then be disclosed to the attacker.
Successful exploitation of this vulnerability c
Exploit-DB
PowerScripts PlusMail WebConsole 1.0 - Weak Authentication (3)
exploitdb·2000-01-20
CVE-2000-0074 PowerScripts PlusMail WebConsole 1.0 - Weak Authentication (3)
PowerScripts PlusMail WebConsole 1.0 - Weak Authentication (3)
---
// source: https://www.securityfocus.com/bid/2653/info
PowerScripts PlusMail Web Control Panel is a web-based administration suite for maintaining mailing lists, mail aliases, and web sites. It is reportedly possible to change the administrative username and password without knowing the current one, by passing the proper arguments to the plusmail script. After this has been accomplished, the web console allows a range of potentially destructive activities including changing of e-mail aliases, mailing lists, web site editing, and various other privileged tasks. This can be accomplished by submitting the argument "new_login" with the value "reset password" to the plusmail script (typically /cgi-bin/plusmail). Other argumen
Exploit-DB
PowerScripts PlusMail WebConsole 1.0 - Weak Authentication (1)
exploitdb·2000-01-11
CVE-2000-0074 PowerScripts PlusMail WebConsole 1.0 - Weak Authentication (1)
PowerScripts PlusMail WebConsole 1.0 - Weak Authentication (1)
---
// source: https://www.securityfocus.com/bid/2653/info
PowerScripts PlusMail Web Control Panel is a web-based administration suite for maintaining mailing lists, mail aliases, and web sites. It is reportedly possible to change the administrative username and password without knowing the current one, by passing the proper arguments to the plusmail script. After this has been accomplished, the web console allows a range of potentially destructive activities including changing of e-mail aliases, mailing lists, web site editing, and various other privileged tasks. This can be accomplished by submitting the argument "new_login" with the value "reset password" to the plusmail script (typically /cgi-bin/plusmail). Other argumen
Exploit-DB
PowerScripts PlusMail WebConsole 1.0 - Weak Authentication (2)
exploitdb·2000-01-11
CVE-2000-0074 PowerScripts PlusMail WebConsole 1.0 - Weak Authentication (2)
PowerScripts PlusMail WebConsole 1.0 - Weak Authentication (2)
---
// source: https://www.securityfocus.com/bid/2653/info
PowerScripts PlusMail Web Control Panel is a web-based administration suite for maintaining mailing lists, mail aliases, and web sites. It is reportedly possible to change the administrative username and password without knowing the current one, by passing the proper arguments to the plusmail script. After this has been accomplished, the web console allows a range of potentially destructive activities including changing of e-mail aliases, mailing lists, web site editing, and various other privileged tasks. This can be accomplished by submitting the argument "new_login" with the value "reset password" to the plusmail script (typically /cgi-bin/plusmail). Other argumen
No writeups or analysis indexed.
2000-01-11
Published