Headstart Solutions DeskPRO stores sensitive information under the web root...

7.5 CVSS

Vulnerability Description

Headstart Solutions DeskPRO stores sensitive information under the web root with insufficient access control, which allows remote attackers to (1) list files in the includes/ directory; obtain the SQL username and password via a direct request for (2) config.php and (3) config.php.bak in includes/; read files in (4) email/, (5) admin/graphs/, (6) includes/javascript/, and (7) certain other includes/ directories via direct requests; and download SQL database data via direct requests for (8) data.sql, (9) install.sql, (10) settings.sql, and possibly other files in install/v2data/.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2006-6974

Check My Exposure

Credits & Attribution

No credits recorded in the NVD database.

References

http://www.zion-security.com/text/Mul_Vulnerability_DeskPro.txt

Affected Vendor

headstart solutions

View all reports →

Affected Software

deskpro

Vulnerable Versions:

Unknown

Timeline

Official Publish: February 7th, 2007

Last Modified: September 16th, 2024

Added to House: July 18th, 2026

CVSS Vectors

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.