CVE-2006-6973

Headstart Solutions DeskPRO does not require authentication for certain files and directories associated with administrative activities, which allows remote attackers to (1) reinstall the application via a direct request for install/index.php; (2) delete the database via a do=delete_database QUERY_STRING to a renamed copy of install/index.php; or access the administration system, after guessing a filename, via a direct request for a file in (3) admin/ or (4) tech/.

Score

CVSS 2.0 7.5 High

Status

Modified - cve@mitre.org

Published

2007-02-07

Last modified

2024-09-16

Affected products

• Deskpro (Headstart Solutions)

References

• http://www.zion-security.com/text/Mul_Vulnerability_DeskPro.txt