CVE-2004-2061

Critical

Published: 27/07/2004(UTC)Translated: 30/05/2026(UTC)NVD NIST

Summary

RiSearch 1.0.01 and RiSearch Pro 3.2.06 allow remote attackers to use the show.pl script as an open proxy or read arbitrary local files by setting the url parameter to a http://, ftp://, or file:// URL.

Risk Assessment

An attacker can use the server as a proxy to hide their activity or access sensitive files on the server, potentially leading to data leakage and security breaches.

Recommendation

Update RiSearch to the latest version or apply a patch that restricts the url parameter to allowed protocols and addresses.

Original NVD description (English source)

RiSearch 1.0.01 and RiSearch Pro 3.2.06 allows remote attackers to use the show.pl script as an open proxy, or read arbitrary local files, by setting the url parameter to a (1) http://, (2) ftp://, or (3) file:// URL.