CVE-2009-0700

Plunet BusinessManager <4.1 - Auth Bypass

Title source: llm
STIX 2.1

Description

Plunet BusinessManager 4.1 and earlier allows remote authenticated users to bypass access restrictions and (1) read sensitive Customer or Order data via a modified Pfad parameter to pagesUTF8/Sys_DirAnzeige.jsp, or (2) list sensitive Jobs via a direct request to pagesUTF8/auftrag_job.jsp.

Exploits (2)

exploitdb WRITEUP VERIFIED
by Matteo Ignaccolo · textwebappsjsp
https://www.exploit-db.com/exploits/32709
exploitdb WRITEUP VERIFIED
by Matteo Ignaccolo · textwebappsjsp
https://www.exploit-db.com/exploits/32710

References (5)

Core 5
Core References
Exploit mailing-list x_refsource_bugtraq
http://archives.neohapsis.com/archives/bugtraq/2009-01/0032.html
Third Party Advisory mailing-list x_refsource_bugtraq
http://archives.neohapsis.com/archives/bugtraq/2009-01/0054.html
Third Party Advisory, VDB Entry vdb-entry x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/47794
Exploit vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/33153

Scores

EPSS 0.0386
EPSS Percentile 88.3%

Details

CWE
CWE-264
Status published
Products (1)
plunet/business_manager < 4.1
Published Feb 23, 2009
Tracked Since Feb 18, 2026