CVE-2006-4653 - Vulnerability Details - OpenCVE

Description

(1) Amazing Little Poll and (2) Amazing Little Picture Poll store sensitive information under the web root with insufficient access control, which allows remote attackers to read the admin password via a direct request for the lp_settings file (lp_settings.inc or lp_settings.php).

Published: 2006-09-09

Score: 5.0 Medium

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

No analysis available yet.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

n/a

n/a

affected

Version	Status	Constraints
`n/a`	affected	—

Configuration 1 [-]

OR	cpe:2.3:a:amazing_little_picture_poll:amazing_little_picture_poll::::::::
	cpe:2.3:a:amazing_little_poll:amazing_little_poll::::::::

No data.

No data available yet.

Remediation

No remediation available yet.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
EUVD	EUVD-2006-4641	(1) Amazing Little Poll and (2) Amazing Little Picture Poll store sensitive information under the web root with insufficient access control, which allows remote attackers to read the admin password via a direct request for the lp_settings file (lp_settings.inc or lp_settings.php).

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

Access Vector Network

Access Complexity Low

Authentication None

Confidentiality Impact Partial

Integrity Impact None

Availability Impact None

This CVE is not in the KEV list.

The EPSS score is 0.00527.

Key SSVC decision points have not yet been added.

References

Link	Providers
http://secunia.com/advisories/21997
http://securityreason.com/securityalert/1527
http://www.securityfocus.com/archive/1/445081/100/0/threaded
http://www.securityfocus.com/bid/19837
http://www.vupen.com/english/advisories/2006/3687
https://exchange.xforce.ibmcloud.com/vulnerabilities/28737

History

No history.

Subscriptions

Amazing Little Picture Poll Amazing Little Picture Poll

Amazing Little Poll Amazing Little Poll

MITRE

Status: PUBLISHED

Assigner: mitre

Published: 2006-09-09T00:00:00.000Z

Updated: 2024-08-07T19:23:40.448Z

Reserved: 2006-09-08T00:00:00.000Z

Link: CVE-2006-4653

Vulnrichment

No data.

NVD

Status : Deferred

Published: 2006-09-09T00:04:00.000

Modified: 2025-04-03T01:03:51.193

Link: CVE-2006-4653

Redhat

No data.

OpenCVE Enrichment

No data.

Weaknesses

NVD-CWE-Other

{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "datePublic": "2006-09-04T00:00:00.000Z", "descriptions": [{"lang": "en", "value": "(1) Amazing Little Poll and (2) Amazing Little Picture Poll store sensitive information under the web root with insufficient access control, which allows remote attackers to read the admin password via a direct request for the lp_settings file (lp_settings.inc or lp_settings.php)."}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2018-10-17T20:57:01.000Z", "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre"}, "references": [{"name": "19837", "tags": ["vdb-entry", "x_refsource_BID"], "url": "http://www.securityfocus.com/bid/19837"}, {"name": "20060904 The Amazing Little Poll Admin Pwd", "tags": ["mailing-list", "x_refsource_BUGTRAQ"], "url": "http://www.securityfocus.com/archive/1/445081/100/0/threaded"}, {"name": "1527", "tags": ["third-party-advisory", "x_refsource_SREASON"], "url": "http://securityreason.com/securityalert/1527"}, {"name": "21997", "tags": ["third-party-advisory", "x_refsource_SECUNIA"], "url": "http://secunia.com/advisories/21997"}, {"name": "ADV-2006-3687", "tags": ["vdb-entry", "x_refsource_VUPEN"], "url": "http://www.vupen.com/english/advisories/2006/3687"}, {"name": "alpoll-admin-auth-bypass(28737)", "tags": ["vdb-entry", "x_refsource_XF"], "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/28737"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "cve@mitre.org", "ID": "CVE-2006-4653", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "(1) Amazing Little Poll and (2) Amazing Little Picture Poll store sensitive information under the web root with insufficient access control, which allows remote attackers to read the admin password via a direct request for the lp_settings file (lp_settings.inc or lp_settings.php)."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "19837", "refsource": "BID", "url": "http://www.securityfocus.com/bid/19837"}, {"name": "20060904 The Amazing Little Poll Admin Pwd", "refsource": "BUGTRAQ", "url": "http://www.securityfocus.com/archive/1/445081/100/0/threaded"}, {"name": "1527", "refsource": "SREASON", "url": "http://securityreason.com/securityalert/1527"}, {"name": "21997", "refsource": "SECUNIA", "url": "http://secunia.com/advisories/21997"}, {"name": "ADV-2006-3687", "refsource": "VUPEN", "url": "http://www.vupen.com/english/advisories/2006/3687"}, {"name": "alpoll-admin-auth-bypass(28737)", "refsource": "XF", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/28737"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-07T19:23:40.448Z"}, "title": "CVE Program Container", "references": [{"name": "19837", "tags": ["vdb-entry", "x_refsource_BID", "x_transferred"], "url": "http://www.securityfocus.com/bid/19837"}, {"name": "20060904 The Amazing Little Poll Admin Pwd", "tags": ["mailing-list", "x_refsource_BUGTRAQ", "x_transferred"], "url": "http://www.securityfocus.com/archive/1/445081/100/0/threaded"}, {"name": "1527", "tags": ["third-party-advisory", "x_refsource_SREASON", "x_transferred"], "url": "http://securityreason.com/securityalert/1527"}, {"name": "21997", "tags": ["third-party-advisory", "x_refsource_SECUNIA", "x_transferred"], "url": "http://secunia.com/advisories/21997"}, {"name": "ADV-2006-3687", "tags": ["vdb-entry", "x_refsource_VUPEN", "x_transferred"], "url": "http://www.vupen.com/english/advisories/2006/3687"}, {"name": "alpoll-admin-auth-bypass(28737)", "tags": ["vdb-entry", "x_refsource_XF", "x_transferred"], "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/28737"}]}]}, "cveMetadata": {"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "cveId": "CVE-2006-4653", "datePublished": "2006-09-09T00:00:00.000Z", "dateReserved": "2006-09-08T00:00:00.000Z", "dateUpdated": "2024-08-07T19:23:40.448Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:amazing_little_picture_poll:amazing_little_picture_poll:*:*:*:*:*:*:*:*", "matchCriteriaId": "DF963F31-0ABF-4663-A49A-309AC74CC0F0", "vulnerable": true}, {"criteria": "cpe:2.3:a:amazing_little_poll:amazing_little_poll:*:*:*:*:*:*:*:*", "matchCriteriaId": "28CB1290-0882-43F7-8370-43708F0A4914", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "(1) Amazing Little Poll and (2) Amazing Little Picture Poll store sensitive information under the web root with insufficient access control, which allows remote attackers to read the admin password via a direct request for the lp_settings file (lp_settings.inc or lp_settings.php)."}, {"lang": "es", "value": "(1) Amazing Little Poll y (2) Amazing Little Picture Poll almacenan informaci\u00f3n sensible bajo la raiz web con insuficiente control de acceso, lo cual permite a un atacante remoto leer la contrase\u00f1a del admin a trav\u00e9s de respuestas directas del archivo lp_settings (lp_settings.inc o lp_settings.php)."}], "id": "CVE-2006-4653", "lastModified": "2025-04-03T01:03:51.193", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 5.0, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}]}, "published": "2006-09-09T00:04:00.000", "references": [{"source": "cve@mitre.org", "url": "http://secunia.com/advisories/21997"}, {"source": "cve@mitre.org", "url": "http://securityreason.com/securityalert/1527"}, {"source": "cve@mitre.org", "url": "http://www.securityfocus.com/archive/1/445081/100/0/threaded"}, {"source": "cve@mitre.org", "url": "http://www.securityfocus.com/bid/19837"}, {"source": "cve@mitre.org", "url": "http://www.vupen.com/english/advisories/2006/3687"}, {"source": "cve@mitre.org", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/28737"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://secunia.com/advisories/21997"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://securityreason.com/securityalert/1527"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.securityfocus.com/archive/1/445081/100/0/threaded"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.securityfocus.com/bid/19837"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.vupen.com/english/advisories/2006/3687"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/28737"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-Other"}], "source": "nvd@nist.gov", "type": "Primary"}]}