CVE-2007-5113

ROI Revolution Urchin < 5.7.03 - Authentication Bypass

Title source: rule

Description

report.cgi in Google Urchin allows remote attackers to bypass authentication and obtain sensitive information (web server logs) via certain modified query parameters, as demonstrated using the profile, rid, prefs, n, vid, bd, ed, dt, and gtype parameters, a different vulnerability than CVE-2007-5112.

Exploits (1)

exploitdb WRITEUP VERIFIED

by MustLive · textwebappscgi

https://www.exploit-db.com/exploits/30661

View Code ZIP pw:eip

References (5)

[Various Sources] http://ha.ckers.org/blog/20070823/xss-and-possible-information-disclosure-in-urchin/

[Various Sources] http://securityvulns.ru/Sdocument90.html

[Various Sources] http://websecurity.com.ua/1283/

[Third Party Advisory, VDB Entry] http://www.securityfocus.com/archive/1/482006/100/0/threaded

[Third Party Advisory, VDB Entry] http://www.securityfocus.com/bid/26037

Scores

EPSS 0.0481

EPSS Percentile 89.3%

Classification

CWE

CWE-287

Status draft

Affected Products (1)

roi_revolution/urchin < 5.7.03

Timeline

Published Sep 26, 2007

Tracked Since Feb 18, 2026