CVE-2005-2474

Description

ChurchInfo allows remote attackers to execute obtain sensitive information via the PersonID parameter to (1) PersonView.php, (2) MemberRoleChange.php, (3) PropertyAssign.php, (4) WhyCameEditor.php, (5) GroupPropsEditor.php, (6) Reports/PDFLabel.php, or (7) UserDelete.php, an invalid Number parameter to (8) SelectList.php or (9) SelectDelete.php, GroupID parameter to (10) GroupView.php, (11) GroupMemberList.php, (12) MemberRoleChange.php, (13) GroupDelete.php, (14) /Reports/ClassAttendance.php, or (15) /Reports/GroupReport.php, (16) PropertyID parameter to PropertyEditor.php, FamilyID parameter to (17) Canvas05Editor.php, (18) CanvasEditor.php, or (19) FamilyView.php, or (20) PledgeID parameter to PledgeDetails.php, which reveal the path in an error message.

5.0

CVSS

Severity: Medium

CVSS 2.0 •

EPSS 1.09% Top 25%

Third-Party Advisory secunia.com

Affected: n/a n/a

References

Link	Tags
http://www.osvdb.org/18430	vdb entry
http://www.osvdb.org/18450	vdb entry
http://www.osvdb.org/18432	vdb entry
http://www.osvdb.org/18435	vdb entry
http://marc.info/?l=bugtraq&m=112291550713546&w=2	mailing list
http://www.osvdb.org/18425	vdb entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/21648	vdb entry
http://www.osvdb.org/18426	vdb entry
http://securitytracker.com/id?1014617	vdb entry
http://www.osvdb.org/18439	vdb entry
http://www.osvdb.org/18437	vdb entry
http://www.osvdb.org/18429	vdb entry
http://www.osvdb.org/18431	vdb entry
http://www.osvdb.org/18433	vdb entry
http://www.osvdb.org/18438	vdb entry
http://www.osvdb.org/18436	vdb entry
http://www.osvdb.org/18434	vdb entry
http://secunia.com/advisories/16292	third party advisory

Frequently Asked Questions

What is the severity of CVE-2005-2474?: CVE-2005-2474 has been scored as a medium severity vulnerability.
How to fix CVE-2005-2474?: To fix CVE-2005-2474, make sure you are using an up-to-date version of the affected component(s) by checking the vendor release notes. As for now, there are no other specific guidelines available.
Is CVE-2005-2474 being actively exploited in the wild?: It is possible that CVE-2005-2474 is being exploited or will be exploited in a near future based on public information. According to its EPSS score, there is a ~1% probability that this vulnerability will be exploited by malicious actors in the next 30 days.