header-logo
Suggest Exploit
vendor:
Regulus
by:
Unknown
5.5
CVSS
MEDIUM
Information Disclosure
200
CWE
Product Name: Regulus
Affected Version From: Unknown
Affected Version To: Unknown
Patch Exists: NO
Related CWE:
CPE:
Metasploit:
Other Scripts:
Platforms Tested: Unknown
Unknown

Information Disclosure in SAFE TEAM Regulus

An attacker can make a request for the 'staffile' file hosted on a target server in SAFE TEAM Regulus, which contains a list of 'staff' users and their corresponding password hashes. This information can be used to launch further attacks against the vulnerable software.

Mitigation:

Restrict access to the 'staffile' file and ensure proper access controls are in place. Regularly update the software to the latest version.
Source

Exploit-DB raw data:

source: https://www.securityfocus.com/bid/11132/info

SAFE TEAM Regulus is reported prone to an information disclosure vulnerability. It is reported that any user may make a request for the Regulus 'staffile' file hosted on a target server. This file contains a list of Regulus 'staff' users and their corresponding password hashes.

An attacker may employ data that is obtained in this manner to aid in further attacks launched against the vulnerable software.

http://example.com/base-dir/access/stafffile

Navigation

Suggest Exploit

Services By CQR